ETK-2026-2274Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2274",
  "cve_id": null,
  "display_id": "ETK-2026-2274",
  "ghsa_id": "GHSA-82jm-8fx9-mh39",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Confidential container invariant bypasses in tari_engine_types",
  "summary": "The Rust `tari_engine_types` package mishandles balance and commitment invariants for confidential resource containers. An attacker able to submit suitably formed confidential withdrawal or proof-related operations may cause validator termination or create inconsistent commitment state. Exploitation requires access to operations involving confidential resources, particularly where revealed or locked balances and commitments can be manipulated.",
  "mitigation": "Apply the upstream patch or upgrade to a release that includes it; no fixed version is recorded in the advisory. Until then, restrict untrusted access to confidential withdrawal and proof-creation operations, and monitor validators for aborts or invariant errors.",
  "vendor": "rust",
  "product": "rust:tari_engine_types",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.47.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [],
      "package_name": "tari_engine_types",
      "purl": "pkg:cargo/tari_engine_types"
    }
  ],
  "cwes": [
    190
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.8498284,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T05:56:09+00:00",
      "days": -0.9256277887037037,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:09:03.278150+00:00",
      "url": "https://github.com/tari-project/tari-ootle/security/advisories/GHSA-82jm-8fx9-mh39"
    }
  }
}