CVE-2026-55764: Klever-Go Privilege Escalation Vulnerability

CVE-2026-55764 Overview

CVE-2026-55764 is a signed integer overflow vulnerability [CWE-190] in Klever-Go, the Go implementation of the Klever blockchain protocol. Versions prior to 1.7.19 allow a mint-role holder to bypass the finite per-nonce MaxSupply cap on the semi-fungible token (SFT) add-quantity path. A crafted raw Amount wraps the on-chain Circulation counter negative, letting the maximum-supply check pass and crediting roughly MaxInt64 units to the token supply. The flaw corrupts consensus state on the SFT mint path. The fungible token path is not affected because its MintedValue <= 0 guard detects the overflow.

Critical Impact
A mint-role holder can inflate SFT supply by approximately MaxInt64 units in a single transaction, corrupting on-chain accounting and enabling market-value exploitation.

Affected Products

Klever-Go blockchain node prior to version 1.7.19
core/kapp/systemAccount/systemAcount.go component (SFTAddCirculation)
core/kapp/kda/mint.go component (processSemiFungibleAddQuantity)

Discovery Timeline

2026-08-28 - CVE-2026-55764 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55764

Vulnerability Analysis

The vulnerability resides in the SFT add-quantity flow. In core/kapp/systemAccount/systemAcount.go, the SFTAddCirculation function performs meta.Circulation += amount before comparing Circulation against MaxSupply. Because both operands are signed int64 values, a sufficiently large positive amount wraps the running total into a negative value. The subsequent signed comparison against MaxSupply then evaluates as true, so the mint proceeds and credits roughly MaxInt64 units to the token nonce. The counter is left in a corrupted state on chain, and the per-nonce supply ceiling is silently bypassed.

Root Cause

The root cause is the missing overflow check before the supply comparison. The fungible token path handles this correctly using a MintedValue <= 0 guard, which catches the wrap. The SFT path was written without an equivalent guard, so an unchecked signed addition preceded the invariant check. Klever-Go tracked the issue as GHSA-mrpp-v6pg-p54x and gated the correction behind the consensus activation flag FixMarketBuyOverflow to preserve replay determinism.

Attack Vector

Any principal holding the mint role for a semi-fungible token can trigger the flaw over the network by submitting an add-quantity transaction with a raw Amount chosen to overflow the nonce's current Circulation. No user interaction, privilege escalation, or local access is required. The attacker requires only the mint role and network reachability to a validator.

// Security patch: consensus freeze list for exploited accounts
// Source: https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251

package common

import "encoding/hex"

// frozenAccounts is the canonical set of accounts from the
// marketplace value-creation exploit, consulted by IsAccountFrozen
// (the consensus freeze, gated by the FixMarketBuyOverflow fork flag,
// enforced in txProcessor.ProcessTransaction and the proposer build path).
var frozenAccounts = map[string]struct{}{
    // klv12n4z3ef86sfk2z97j4fhfta9f2xztsv6frr8faqj7l8q9kc0fcdsfjfqez (root / minter)
    "54ea28e527d4136508be955374afa54a8c25c19a48c674f412f7ce02db0f4e1b": {},
    // klv1fzemma2s9d35l0hm38wt88srdyyqweufljqtps9jqkv32due3yqswqlfae
    "48b3bdf5502b634fbefb89dcb39e036908076789fc80b0c0b205991537998901": {},
    // klv1qfhu856w9gu8k9skay5sgquvl95erjygkmemycq07xspykqzm6vsqpty2m
    "026fc3d34e2a387b1616e92904038cf96991c888b6f3b2600ff1a0125802de99": {},
}

Source: GitHub Commit 8bcc600. This patch adds a consensus-gated freeze list for accounts implicated in the value-creation exploit, complementing the arithmetic fix in the SFT mint path.

Detection Methods for CVE-2026-55764

Indicators of Compromise

Negative or unexpectedly large positive values in on-chain Circulation fields for SFT nonces, particularly values approaching MaxInt64 (9223372036854775807).
SFT add-quantity transactions from a mint-role holder specifying raw Amount values close to MaxInt64 or that would cause Circulation to exceed the nonce's MaxSupply.
Activity from the addresses enumerated in the frozenAccounts list added by commit 8bcc600.

Detection Strategies

Replay historical SFT mint transactions against a patched 1.7.19 node and flag any transaction that the patched arithmetic would reject.
Alert on any SFT MetaData.Circulation state where the stored value is negative or where its unsigned interpretation exceeds MaxSupply.
Monitor for consensus divergence between pre-patch and post-patch nodes at the FixMarketBuyOverflow activation epoch.

Monitoring Recommendations

Ingest node logs and chain state deltas into a centralized log platform and query for anomalous mint volumes on SFT nonces.
Track transactions signed by mint-role keys and alert on any Amount field greater than the remaining headroom under MaxSupply.
Correlate marketplace buy or sell events against the frozen-account list to identify downstream laundering hops.

How to Mitigate CVE-2026-55764

Immediate Actions Required

Upgrade all Klever-Go nodes to version 1.7.19 or later, which includes the arithmetic fix and the FixMarketBuyOverflow activation gate.
Coordinate the upgrade across validators before the operator-configured activation epoch to avoid consensus divergence at fork time.
Audit SFT token metadata for corrupted Circulation values and prepare reconciliation transactions for affected nonces.

Patch Information

The fix ships in Klever-Go v1.7.19. The corrected SFTAddCirculation path evaluates overflow before applying the addition and rejects transactions that would wrap Circulation. The change is gated behind the FixMarketBuyOverflow consensus flag so replay of historical blocks remains deterministic. Full technical details are documented in the GHSA-mrpp-v6pg-p54x advisory and commit 8bcc600.

Workarounds

Revoke or rotate mint-role keys for high-value SFT collections until the upgrade to 1.7.19 is complete.
Set the FixMarketBuyOverflow activation epoch to a future epoch after full fleet rollout; never activate from genesis or a past epoch, as this replays historical transactions and diverges from chain history.
Restrict marketplace contracts from accepting SFT deposits from the frozen accounts listed in the patch.

bash

# Upgrade Klever-Go to the patched release
git clone https://github.com/klever-io/klever-go.git
cd klever-go
git checkout v1.7.19
make build

# Verify the FixMarketBuyOverflow activation epoch in node config
# is set to a FUTURE epoch, after fleet rollout completes
grep -i "FixMarketBuyOverflow" config/enableEpochs.toml