CVE-2026-28410

5.3 mediumEPSS 0.3%

Medium (5.3) in thegraph graph protocol contracts. EPSS 0.3% chance of exploitation in the next 30 days.

The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vesting contracts allows users to access tokens that should still be locked according to their vesting schedule. This issue has been patched in version 3.0.0.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWEs: CWE-284, CWE-682
Published: 2026-03-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

thegraph:graph_protocol_contracts

References

https://github.com/graphprotocol/contracts/commit/91224ed83eeff3fc3afea01f5ed269373d9bf773
https://github.com/graphprotocol/contracts/security/advisories/GHSA-qx35-rc5x-x39r

Check your stack JSON