{"id":"CVE-2026-117602","kind":"vulnerability","aliases":["CVE-2026-117602"],"related":[],"title":"Electrum: external plugin loader runs unsigned plugin code without authorization check","description":"Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.","summary":"Electrum 4.6.0 before 4.7.2 loads a plugin's __init__.py whenever the config marks it enabled, without verifying the plugin-password signature. A local process that can write to the Electrum data directory can drop a plugin and enable it, running arbitrary code inside the Electrum wallet process.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitcoin-wallet","desktop","electrum","local-users","package"],"not_affected_if":["no-local-write-access-to-data-directory","versions-4.7.2-or-later"],"how_to_check":"- Run `electrum version` and confirm the installed version is below `4.7.2`.\n- Check the Electrum data directory for unexpected folders under `plugins/` and for enabled plugin entries in the config file that no one on the team set.","fix":"- Upgrade Electrum to `4.7.2` or later.\n- Until upgraded, restrict write access to the Electrum data directory to the wallet user only.","status":"open","published_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:32:44+00:00","updated_at":"2026-10-27T14:32:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T14:32:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Electrum to `4.7.2` or later.\n- Until upgraded, restrict write access to the Electrum data directory to the wallet user only.","reach":"local","title":"Electrum: external plugin loader runs unsigned plugin code without authorization check","impact":"high","summary":"Electrum 4.6.0 before 4.7.2 loads a plugin's __init__.py whenever the config marks it enabled, without verifying the plugin-password signature. A local process that can write to the Electrum data directory can drop a plugin and enable it, running arbitrary code inside the Electrum wallet process.","category":"package","nicknames":[],"who_cares":["electrum","bitcoin-wallet","desktop","local-users"],"confidence":0.7,"needs_auth":"no","worst_case":"Arbitrary code runs inside the Electrum process, exposing wallet keys.","analyst_note":"Confirm from the NVD entry or the Electrum release notes whether 4.7.2 is the only fixed version and whether a config-level workaround exists.","how_to_check":"- Run `electrum version` and confirm the installed version is below `4.7.2`.\n- Check the Electrum data directory for unexpected folders under `plugins/` and for enabled plugin entries in the config file that no one on the team set.","needs_analyst":true,"not_affected_if":["versions-4.7.2-or-later","no-local-write-access-to-data-directory"],"who_is_affected":"Anyone running Electrum 4.6.0 through 4.7.1 on a machine where other local processes or users can write to the Electrum data directory. Exposure requires local write access; remote attackers without a foothold on the machine are not described as able to trigger it. Systems where only the owning user runs Electrum with a locked-down data directory are lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":3361,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117602':14A,17A '-2026':13A,16A '4.6.0':28B,77C '4.7.2':30B,79C 'access':120C 'arbitrari':69B,139C 'author':10A,82C 'bitcoin':19B 'bitcoin-wallet':18B 'bypass':83C 'caus':138C 'check':11A 'code':8A,70B,129C,140C 'config':39B,105C 'contain':80C 'cve':12A,15A 'data':59B,124C 'desktop':21B 'directori':60B,125C 'drop':62B 'electrum':1A,22B,27B,58B,73B,76C,123C,144C 'enabl':42B,66B,102C,137C 'execut':90C,141C 'extern':2A,86C 'file':106C 'folder':133C 'init':35B,94C 'insid':71B,142C 'load':31B 'loader':4A,88C 'local':24B,51B,116C 'local-us':23B 'mark':40B,101C,135C 'modul':96C 'packag':26B 'password':48B,112C 'place':127C 'plugin':3A,7A,33B,47B,64B,87C,92C,99C,111C,128C,132C 'plugin-password':46B,110C 'process':52B,75B,117C,145C 'py':36B,95C 'rogu':115C 'run':5A,68B 'signatur':49B,113C 'unsign':6A 'user':25B 'verifi':44B,108C 'wallet':20B,74B 'whenev':37B 'without':9A,43B,107C 'write':55B,119C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Electrum 4.6.0 through 4.7.1 on a machine where other local processes or users can write to the Electrum data directory. Exposure requires local write access; remote attackers without a foothold on the machine are not described as able to trigger it. Systems where only the owning user runs Electrum with a locked-down data directory are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117602","severity":null,"published_at":"2026-10-27T14:16:40+00:00","modified_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}