CVE-2026-82409: Klever-Go Blockchain XSS Vulnerability

CVE-2026-82409 Overview

CVE-2026-82409 is an injection vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol. Versions prior to 1.7.20 fail to escape attacker-controlled account names before serializing them into Elasticsearch _bulk JSON and NDJSON requests. The serializedDataForUpdateAccounts function in indexer/common.go places the raw acc.Name value directly into the bulk payload. Because SetAccountName transactions accept UTF-8 names containing quotes, backslashes, and newlines, an attacker can break the JSON structure and inject additional bulk actions. The malicious name is stored in consensus account state and replayed by any indexer that processes the account.

Critical Impact
Attackers can create, overwrite, or delete Elasticsearch documents in any index writable by the indexer, without direct network access to the indexing host or Elasticsearch port.

Affected Products

Klever-Go blockchain node implementation
Klever-Go versions prior to 1.7.20
Downstream indexers consuming Klever consensus account state

Discovery Timeline

2026-09-23 - CVE-2026-82409 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82409

Vulnerability Analysis

The flaw is an output encoding failure classified as [CWE-116] (Improper Encoding or Escaping of Output). Klever-Go builds an Elasticsearch update-by-script bulk request using fmt.Sprintf-style string formatting. The acc.Name field, populated by a user-submitted SetAccountName transaction, is embedded into a JSON params.name value without any escaping.

The blockchain protocol validates account names as valid UTF-8 but permits quotes ("), backslashes (\), and newlines (\n). These characters have structural meaning in both JSON and the Elasticsearch NDJSON _bulk wire format. An attacker submits a transaction with a crafted Name value that terminates the surrounding JSON string, closes the outer object, and injects arbitrary follow-on bulk actions such as index, update, or delete operations targeting other indices.

Because the malicious name persists in consensus state, every current and future indexer replaying the chain re-injects the payload. This creates a durable, chain-wide compromise vector against the indexing tier.

Root Cause

The root cause is direct string interpolation of untrusted input into a structured serialization format. The pre-patch code passes acc.Name as a %s argument to a format string that builds an Elasticsearch scripted update body. No JSON escaping is applied before the value crosses the trust boundary between consensus state and the indexer's Elasticsearch client.

Attack Vector

An attacker with the ability to submit a signed transaction to the Klever network invokes SetAccountName with a payload containing JSON metacharacters and newline-delimited bulk directives. Once the transaction is included in a block, any indexer processing that account writes the attacker's payload verbatim into the _bulk request. Downstream effects include batch rejection, denial of indexing, and unauthorized document manipulation across every index the indexer can write.

// Patched code in indexer/common.go (Klever-Go v1.7.20)
            `ctx._source.updatedAt = params.updatedAt;`+
            `","lang": "painless","params":`+
            `{"name": "%s", "nonce": %d, "rootHash": "%s", "balance": %d, "frozenBalance": %d, "unfrozenBalance": %d, "allowance": %d, "permissions": %s, "updatedAt": %d}}}`,
-           acc.Name, acc.Nonce, acc.RootHash, acc.Balance, acc.FrozenBalance, acc.UnfrozenBalance, acc.Allowance, string(pData), acc.UpdatedAt))
+           converters.JsonEscape(acc.Name), acc.Nonce, acc.RootHash, acc.Balance, acc.FrozenBalance, acc.UnfrozenBalance, acc.Allowance, string(pData), acc.UpdatedAt))

        err = buffSlice.PutData(metaData, serializedData)
        if err != nil {
// Source: https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af

The patch wraps acc.Name in a converters.JsonEscape call, ensuring quotes, backslashes, and control characters are properly encoded before insertion into the bulk request.

Detection Methods for CVE-2026-82409

Indicators of Compromise

Elasticsearch _bulk requests rejected with JSON parse errors originating from the Klever indexer process.
Unexpected index, update, or delete actions in indices touched by the indexer service account.
Account documents whose name field contains embedded quotes, backslashes, or newline characters.
SetAccountName transactions with payloads containing ", \, \n, or NDJSON action keywords (index, delete, update).

Detection Strategies

Parse Klever indexer logs for bulk serialization errors or Elasticsearch 400-class responses correlated with recent SetAccountName transactions.
Enumerate on-chain account state for names containing control characters or JSON structural bytes and flag matches for review.
Diff Elasticsearch document counts and mapping changes against expected indexing volume to identify injected write operations.

Monitoring Recommendations

Enable Elasticsearch audit logging on all indices writable by the indexer and alert on writes to unexpected indices.
Monitor Klever node upgrade status to confirm all indexer instances are running 1.7.20 or later.
Track SetAccountName transaction volume and payload entropy to identify anomalous submission patterns.

How to Mitigate CVE-2026-82409

Immediate Actions Required

Upgrade all Klever-Go nodes and indexer processes to version 1.7.20 or later.
Audit consensus account state for names containing JSON metacharacters and quarantine suspect records before re-indexing.
Rebuild Elasticsearch indices from a clean snapshot taken prior to any suspected injection event.
Restrict the indexer's Elasticsearch credentials to the minimum set of indices required for operation.

Patch Information

The fix is available in Klever Go Release v1.7.20. The relevant changes are in commit f00366768 and commit f54ea730, which wrap the account name value with converters.JsonEscape before serialization. Full context is documented in the Klever Go Security Advisory GHSA-7c7c-373r-gfjj.

Workarounds

Deploy a validating proxy between the indexer and Elasticsearch that rejects _bulk payloads containing unexpected action lines.
Apply protocol-level input validation that rejects SetAccountName transactions containing quotes, backslashes, or newline characters until nodes are patched.
Scope the Elasticsearch API key used by the indexer to a single dedicated index with no delete privileges.

bash

# Verify running Klever-Go version and upgrade
klever-go --version
# Expected output: v1.7.20 or later

# Pull and build the patched release
git clone https://github.com/klever-io/klever-go.git
cd klever-go
git checkout v1.7.20
make build