A serious security flaw could let hackers disrupt servers that help run Cardano, raising concerns for holders staking roughly 21.5 billion ADA, about 58% of the circulating supply.
So far, no Cardano pool attack has been reported.
What Is the New Cardano Security Risk?
On October 30, Cardano coordinating group Intersect warned pool operators about CVE-2026-98432, a Linux vulnerability rated 9.8 out of 10 for severity.
Linux runs many of the servers that produce Cardano blocks. The bug lets specially crafted internet requests confuse how a server handles memory. It could crash the machine or, in certain configurations, let an outsider take control without a password.
On October 27, Anthropic said its Claude AI had developed such an attack against servers using multipath TCP, a networking feature. Its test took 53 minutes. Public test code later appeared, although it did not demonstrate a complete takeover.
Can Hackers Steal ADA or Stop Staking Rewards?
Cardano staking allows holders to back a pool that produces blocks and earns rewards. The ADA never leaves the holder’s wallet.
“Your ada stays in your wallet and remains spendable at any time,” Cardano states.
Hijacking a pool therefore does not give hackers ownership of its delegators’ coins. But taking its server offline could reduce the blocks produced and the rewards paid out.
“Poor stake pool performance decreases the number of rewards that a pool and its members receive,” Cardano explains.
No stolen funds or reward losses have been linked to this flaw. ADA’s price could suffer if disruptions became widespread, but there is no established direct market impact.
Are Cardano Operators Protected?
Patches are arriving unevenly. Intersect has urged operators to check their servers, then update and reboot.
| Linux system | Fix status (Oct. 30) |
|---|---|
| Linux (upstream) | Fixed Oct. 5 |
| Ubuntu | Vulnerable; fix in progress |
| Red Hat Enterprise Linux | Fix pending |
| AlmaLinux | Patched kernels in testing |
Last November, a separate bug briefly split Cardano into two chains. No user funds were compromised. This warning concerns the infrastructure running the network, and the outcome depends on patching.
