CVE-2026-24471: continuwuity Matrix homeserver: arbitrary event signing via malicious remote server
CVE-2026-24471 affects continuwuity, a Rust Matrix homeserver, and Conduit-derived servers. A malicious remote server can induce the local server to sign an arbitrary event during user-triggered room leave, join or knock actions. The GitHub CNA rates it critical with a CVSS 4.0 score of 9.3, and fixes are listed for continuwuity, Conduit, Grapevine and Tuwunel.
Overview
CVE-2026-24471 is a flaw in continuwuity, a Matrix homeserver written in Rust, and in Conduit-derived servers. According to the record, a malicious remote server can cause the local server to sign an arbitrary event after a user action such as leaving a room, joining a room or knocking on a room. The GitHub CNA assigned the weakness CWE-441 and rated it critical.
Impact
The CVSS 4.0 vector in the record shows a network-reachable attack that requires no privileges but does require user interaction. The vector also marks high impact to confidentiality, integrity and availability of the vulnerable system. A server that signs events it did not originate may have its federation identity used to produce content it never intended to sign.
Affected products and versions
- continuwuity: the record states the fix is in version 0.5.1.
- Conduit: the record states the fix is in version 0.10.11.
- Grapevine: the record states the fix is in commit 0aae932b.
- Tuwunel: the record states the fix is in version 1.4.9.
- Conduit-derived servers: the description states that all of them are affected.
The record does not list affected version ranges, so the exact vulnerable versions cannot be determined from the sources consulted. The affected and fixed lists in the record are empty, so the information comes only from the description.
Exploitation status
The CISA KEV entry for this CVE is not listed in the record. The description states that the flaw was exploited as part of a larger chain against the continuwuity.org homeserver. No active exploitation or exploitation in the wild is confirmed in the sources consulted.
Remediation and mitigation
- Upgrade continuwuity to 0.5.1 or later, Conduit to 0.10.11 or later, Tuwunel to 1.4.9 or later, and apply the Grapevine commit referenced in the record.
- Confirm the exact fix for your distribution by reading the GitHub Security Advisory and the referenced commit.
- Review federation policies and limit federation to trusted servers while patching is in progress, as an interim risk reduction.
Detection guidance
- Review federation and room-membership logs for unexpected signing requests or responses involving remote servers that you do not normally trust.
- Look for membership events created near leave, join or knock actions that contain unusual origin or timestamp values or unexpected content fields.
- Track outbound requests from your server to remote servers during these actions and investigate spikes from unfamiliar peers.
Limitations of the available information
The record provides no affected version ranges, no product-level affected entries, no EPSS score and no SSVC assessment. The referenced commit and advisory were not verified in this analysis. The record does not describe the wider chain against continuwuity.org or its impact.
Frequently asked questions
What is CVE-2026-24471?
It is a flaw in continuwuity and Conduit-derived Matrix servers where a malicious remote server can cause the local server to sign an arbitrary event after a user leaves, joins or knocks on a room.
Which versions fix the issue?
The record lists fixes in continuwuity 0.5.1, Conduit 0.10.11, Grapevine commit 0aae932b and Tuwunel 1.4.9. Check the GitHub advisory for the authoritative details.
Is this vulnerability actively exploited?
The record does not list it in CISA KEV. The description says it was used as part of a larger chain against continuwuity.org, but active exploitation is not confirmed in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.