Decentralized Vulnerability Disclosure via Permissioned Blockchain: A Secure, Transparent Alternative to Centralized CVE Management
Novruz Amirov, Kemal Bicakci
TL;DR
The paper addresses the risk of single-point failure and governance fragility in the centralized CVE disclosure system by proposing a permissioned blockchain solution. It designs a Hyperledger Fabric-based architecture where CNAs operate as validated members, and smart contracts enforce CVE lifecycle, embargoes, and governance, yielding public verifiability and tamper-evident records. A prototype demonstrates feasibility with performance benchmarks around 200 TPS and sub-2-second latency, highlighting improvements in transparency, auditability, and resilience over the MITRE-centric model. The work sets the stage for extended capabilities such as decentralized identity, zero-knowledge proofs, and cross-ledger interoperability in vulnerability disclosure and related cyber threat intelligence domains.
Abstract
This paper proposes a decentralized, blockchain-based system for the publication of Common Vulnerabilities and Exposures (CVEs), aiming to mitigate the limitations of the current centralized model primarily overseen by MITRE. The proposed architecture leverages a permissioned blockchain, wherein only authenticated CVE Numbering Authorities (CNAs) are authorized to submit entries. This ensures controlled write access while preserving public transparency. By incorporating smart contracts, the system supports key features such as embargoed disclosures and decentralized governance. We evaluate the proposed model in comparison with existing practices, highlighting its advantages in transparency, trust decentralization, and auditability. A prototype implementation using Hyperledger Fabric is presented to demonstrate the feasibility of the approach, along with a discussion of its implications for the future of vulnerability disclosure.