---
id: "CVE-2026-62162"
kind: "vulnerability"
aliases: ["CVE-2026-62162"]
title: "Hydra: pending Cardano deposits can be redirected by any third party"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["blockchain", "cardano", "hydra", "package"]
not_affected_if: ["hydra-2.1.0-or-later", "no-pending-deposits"]
published_at: "2026-10-30T19:18:32+00:00"
first_seen_at: "2026-10-30T19:25:30+00:00"
updated_at: "2026-10-30T19:25:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62162", "first_seen_at": "2026-10-30T19:25:30+00:00"}]
---

# Hydra: pending Cardano deposits can be redirected by any third party

Hydra, a Cardano layer-two scalability solution, has a deposit validator that does not check that the Head state-token UTxO is spent in the same transaction. Before the deposit deadline, any party able to build a Cardano transaction can consume a pending deposit and send the assets to an arbitrary address.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Hydra version in use: `hydra-node --version` (unknown if the sources give a command for this).
- Look for deposits made through `POST /commit` that are still pending, before the deposit deadline (three times depositPeriod by default).

## Fix

- Hydra: `2.1.0`

## Timeline

- 2026-10-30T19:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62162

## From the sources

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_