{"id":"CVE-2026-117603","kind":"vulnerability","aliases":["CVE-2026-117603"],"related":[],"title":"Electrum: Nostr Wallet Connect plugin lets clients exceed spending limits","description":"Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.","summary":"Electrum before 4.7.2 has a Nostr Wallet Connect plugin where concurrent pay_invoice requests race past the daily spending check, and millisatoshi amounts are truncated, letting a malicious NWC client drain more than the configured daily_limit_sat. The sources describe this as a loss of funds beyond the set limit.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitcoin-wallet","electrum","nostr","nwc","package"],"not_affected_if":["no-nwc-clients","plugin-disabled"],"how_to_check":"- Run `electrum version` and confirm whether it is below `4.7.2`.\n- Check whether the Nostr Wallet Connect plugin is enabled and whether any NWC client is paired with the wallet.\n- Look for a `daily_limit_sat` setting in the NWC plugin configuration.","fix":"- Upgrade Electrum to `4.7.2` or later.\n- Until upgraded, disable the Nostr Wallet Connect plugin or revoke NWC client connections.","status":"open","published_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:32:43+00:00","updated_at":"2026-10-27T14:32:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T14:32:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Electrum to `4.7.2` or later.\n- Until upgraded, disable the Nostr Wallet Connect plugin or revoke NWC client connections.","reach":"network","title":"Electrum: Nostr Wallet Connect plugin lets clients exceed spending limits","impact":"high","summary":"Electrum before 4.7.2 has a Nostr Wallet Connect plugin where concurrent pay_invoice requests race past the daily spending check, and millisatoshi amounts are truncated, letting a malicious NWC client drain more than the configured daily_limit_sat. The sources describe this as a loss of funds beyond the set limit.","category":"package","nicknames":[],"who_cares":["electrum","bitcoin-wallet","nostr","nwc"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Funds drained beyond the configured daily spending limit by a malicious client","analyst_note":"Confirm the NWC client pairing requirement and whether the 4.7.2 fix is in the upstream Electrum release notes; sources give no detail beyond NVD.","how_to_check":"- Run `electrum version` and confirm whether it is below `4.7.2`.\n- Check whether the Nostr Wallet Connect plugin is enabled and whether any NWC client is paired with the wallet.\n- Look for a `daily_limit_sat` setting in the NWC plugin configuration.","needs_analyst":true,"not_affected_if":["plugin-disabled","no-nwc-clients"],"who_is_affected":"Only users running Electrum with the Nostr Wallet Connect plugin enabled and at least one NWC client connected are exposed, since the flaw is in how that plugin enforces its budget. Wallets without the plugin or without paired NWC clients are not affected by this flaw.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000673,"input_tokens":3396,"output_tokens":666,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-117603':13A,16A '-2026':12A,15A '4.7.2':26B,77C 'add':123C 'allow':91C,120C 'amount':46B,131C 'atom':104C 'attack':110C 'beyond':71B,141C 'bitcoin':18B 'bitcoin-wallet':17B 'budget':105C,119C,125C 'bypass':82C 'check':43B,106C 'client':7A,53B,94C 'concurr':34B,113C 'configur':58B 'connect':4A,31B,88C 'contain':78C 'cve':11A,14A 'daili':41B,59B,97C 'describ':64B 'drain':54B,139C 'electrum':1A,20B,24B,75C 'exceed':8A,96C 'exploit':101C 'floor':134C 'fund':70B,140C 'invoic':36B,115C 'let':6A,49B 'limit':10A,60B,74B,81C,98C,143C 'loss':68B 'malici':51B,92C 'millisatoshi':45B,108C 'msat':130C 'non':103C 'non-atom':102C 'nostr':2A,21B,29B,86C 'nwc':22B,52B,93C 'packag':23B 'pass':118C 'past':39B 'pay':35B,114C,129C 'plugin':5A,32B,89C 'race':38B 'repeat':128C 'request':37B,116C 'run':126C 'sat':61B,99C 'satoshi':137C 'send':112C 'set':73B 'sourc':63B 'spend':9A,42B,80C,121C 'truncat':48B,109C 'vulner':83C 'wallet':3A,19B,30B,87C 'whole':136C","nicknames":[],"mitigations":[],"who_affected":"Only users running Electrum with the Nostr Wallet Connect plugin enabled and at least one NWC client connected are exposed, since the flaw is in how that plugin enforces its budget. Wallets without the plugin or without paired NWC clients are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117603","severity":null,"published_at":"2026-10-27T14:16:40+00:00","modified_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}