{"action":"Upgrade anchor-lang to 1.0.0-rc.2 or later.","affected":[{"fixed":"1.0.0-rc.2","introduced":"1.0.0-rc.1"}],"component":"anchor-lang","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["1.0.0-rc.2"],"ghsa_id":"GHSA-429q-fhh4-r6hj","id":"tcs_01M5KFBGDZHQ7HZPJDFM2M0JW6","modified_at":"2026-10-12T18:00:08.341270961Z","published_at":"2026-05-08T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0146","https://crates.io/crates/anchor-lang","https://rustsec.org/advisories/RUSTSEC-2026-0146.html","https://github.com/solana-foundation/anchor/pull/3837","https://github.com/otter-sec/anchor/pull/3837","https://github.com/otter-sec/anchor/pull/4139","https://github.com/otter-sec/anchor/commit/26ef36968a62e28a1f028e7adae4806af30c747d"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0146","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0146"}],"summary":"`InterfaceAccount` allows account substitution between unexpected types"}