# Axelar publishes CometBFT security-patch release v1.3.8

> A patched official validator build became available, creating a concrete infrastructure-version diligence requirement for the watched Axelar dependency.

- URL: https://riadefi.com/on-chain/2026-01-23-axelar-cometbft-csa-2026-001-patch-release/
- Type: Upgrade or migration
- Stage: Confirmed
- Evidence: developing
- Materiality: material
- Event date: 2026-01-23
- Version: 1, published 2026-08-22 (first published 2026-08-22)
- Advisor-relevant: no
- Affects: Axelar (protocol)

Developing. Some claims here are not yet confirmed; they are listed apart from the confirmed facts. A new version replaces this one when the primary evidence changes.

## What happened

Axelar published axelar-core v1.3.8 with an upgraded CometBFT dependency containing the fix for CSA-2026-001.

## What changed

A patched official validator build became available, creating a concrete infrastructure-version diligence requirement for the watched Axelar dependency.

## What did not change

The release says the change is not consensus-breaking and no funds are at risk. It does not prove network-wide validator adoption, an exploit, fund loss, or a gateway-contract change.

## Confirmed

- Axelar Core v1.3.8 was released on 2026-01-23.
- The release upgrades CometBFT with a fix for CSA-2026-001.
- Axelar states that the change is not consensus-breaking and that no funds are at risk.

## Still open

- The cached record does not establish validator adoption of v1.3.8 across the live network.
- The operative vulnerability details and any exposure before upgrade are not stated in the candidate record.

## What it means for an advisor

- Review the Axelar memo's infrastructure-security record and verify that relevant service providers or integrations track the patched validator version.
- Do not infer that release publication alone proves the live validator set has upgraded.

## Sources

1. [Axelar Core v1.3.8](https://github.com/axelarnetwork/axelar-core/releases/tag/v1.3.8) · Axelar · 2026-01-23


---

Published by Ketju Research on RIADeFi (https://riadefi.com). Educational research for financial professionals; not investment, legal, tax, or compliance advice.