Summary
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
Workarounds
There is no application-level workaround. The vulnerability is in consensus logic; remediation requires the network to run the patched (v8.0.0) binary. The bonds module remains disabled in v8.0.0 and will only be re-enabled in a future release once the signer-authorization model has been corrected.
Impact
Type: Improper authorization leading to unauthorized movement of user funds.
The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor.
Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled, later withdrawing and bridging the proceeds off-chain.
This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise, any account holding a balance in a token a bond could use was at risk.
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur.
All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary.
Frequently Asked Questions
- What is CVE-2026-61604? CVE-2026-61604 is a critical-severity missing authorization vulnerability in github.com/ixofoundation/ixo-blockchain/v8 (go), affecting versions < 8.0.0. It is fixed in 8.0.0. The application does not perform an authorization check before performing a sensitive operation.
- Which packages are affected by CVE-2026-61604?
github.com/ixofoundation/ixo-blockchain/v8(go) (versions < 8.0.0)github.com/ixofoundation/ixo-blockchain/v7(go) (versions <= 7.0.0)github.com/ixofoundation/ixo-blockchain/v6(go) (versions <= 6.0.1)github.com/ixofoundation/ixo-blockchain/v5(go) (versions <= 5.0.0)github.com/ixofoundation/ixo-blockchain/v4(go) (versions <= 4.0.0)github.com/ixofoundation/ixo-blockchain/v3(go) (versions <= 3.0.0)github.com/ixofoundation/ixo-blockchain(go) (versions <= 1.6.0)
- Is there a fix for CVE-2026-61604? Yes. CVE-2026-61604 is fixed in 8.0.0. Upgrade to this version or later.
- Is CVE-2026-61604 exploitable, and should I be worried? Whether CVE-2026-61604 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-61604 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-61604? Upgrade
github.com/ixofoundation/ixo-blockchain/v8to 8.0.0 or later.