CVE-2026-41583: ZEBRA Zcash Node Consensus Rule Bypass (CVSS 9.1)

Overview

CVE-2026-41583 is a critical consensus validation vulnerability in ZEBRA, the Zcash node implementation written in Rust by the Zcash Foundation. The flaw carries a CVSS v3.1 base score of 9.1 (Critical) and affects all versions of zebrad prior to 4.3.1 and zebra-script prior to 5.0.2.

Following an internal refactoring of the transaction validation logic, ZEBRA inadvertently removed enforcement of a consensus rule that restricts valid sighash type values for V5 transactions — a transaction format introduced with the NU5 (Network Upgrade 5) activation. This allowed transactions with invalid sighash type bytes to be accepted by affected nodes, potentially breaking Zcash consensus integrity.

Technical Details

Background

Zcash V5 transactions (enabled in the NU5 network upgrade) introduced new cryptographic constructs including Orchard shielded actions. The sighash algorithm for V5 transactions defines a strict set of valid sighash type bytes. ZEBRA's refactored code path failed to re-validate this constraint, meaning nodes running affected versions would accept V5 transactions with out-of-range sighash types that the reference zcashd implementation would reject.

Consensus Impact

In blockchain networks, consensus rule divergence between node implementations is severe. If a significant portion of the Zcash network ran ZEBRA nodes with this bug:

• Attackers could craft V5 transactions with invalid sighash types accepted by ZEBRA but rejected by zcashd
• This could cause a chain split between ZEBRA-majority and zcashd-majority segments of the network
• Under certain conditions, double-spend attacks targeting ZEBRA-accepting nodes may be theoretically possible

Remediation

All ZEBRA node operators should upgrade immediately:

# Update zebrad
cargo install zebrad --version 4.3.1
 
# Verify version
zebrad --version

Or update via the official Zcash Foundation releases on GitHub.

Operators running zebra-script as a standalone crate should pin to >= 5.0.2 in Cargo.toml:

[dependencies]
zebra-script = "5.0.2"

Timeline

• Refactoring introduced: Internal code restructuring removed sighash validation enforcement
• 2026-05-08: CVE published via NVD
• Patched: zebrad 4.3.1 and zebra-script 5.0.2 released by Zcash Foundation

References

• NVD Entry — CVE-2026-41583
• ZEBRA GitHub Repository
• Zcash NU5 Network Upgrade Documentation
• CWE-20: Improper Input Validation