CVE-2026-45056: Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
The matrix-sdk-crypto crate before 0.16.1 is missing a check for the sender’s user ID when decrypting an Olm-encrypted to-device message containing the sender_device_keys property.
This could be exploited to spoof the sender of an encrypted to-device message, but only if the attacker colludes with (or is) the homeserver operator.
References
- github.com/advisories/GHSA-wfq4-36m3-9g42
- github.com/matrix-org/matrix-rust-sdk/pull/6553
- github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
- github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42
- nvd.nist.gov/vuln/detail/CVE-2026-45056
- rustsec.org/advisories/RUSTSEC-2026-0159.html
Code Behaviors & Features
Detect and mitigate CVE-2026-45056 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →