-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0177
============================================================

Advisory-ID:  0xCERT-2026-0177
Severity:     High
Published:    2026-09-23T20:17:19.960Z
Updated:      2026-10-08T22:46:37.535Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0177

Title: CVE-2026-86064: Klever-Go

Summary
- -------
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs,…

Details
- -------
Summary
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

Severity
High (CVSS 8.6), as scored by NVD.

Weakness
- - CWE-200
- - CWE-306

Recommended actions
- - Check whether you run or depend on the affected component and version
- - Apply the vendor's fix or mitigation from the references below

Source & attribution
This 0xCERT advisory summarises CVE-2026-86064 from the U.S. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-86064. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://nvd.nist.gov/vuln/detail/CVE-2026-86064
- - https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2
- - https://github.com/klever-io/klever-go/pull/74
- - https://github.com/klever-io/klever-go/releases/tag/v1.7.20
- - https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm
- - https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRmAJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeqM+BUi40+evxMgTzQTqTU9unBg2NkpcX6zE/C
lZH3DxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADPIQD9HnjPV0uFEsTTHl0V
Nli1f5igkWhyqwZNf+EOCTUibGsA/0boAwRPTpj9pUMw/HRV0zYfMHtg1mx2
lLTvya5ZjJEH
=75n9
-----END PGP SIGNATURE-----