CVE-2026-86064: Klever-Go Information Disclosure Vulnerability

CVE-2026-86064 Overview

CVE-2026-86064 affects Klever-Go, the Go implementation of the Klever blockchain protocol, in versions prior to 1.7.20. The default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. A remote client can connect and send a logger Profile message that is applied process-wide, changing global log levels and formatting until the connection closes. The same connection is registered as a log observer, streaming live process logs to the caller. Klever-Go 1.7.20 fixes the flaw by requiring authentication on the /log route.

Critical Impact
Unauthenticated network attackers can mutate global logger configuration and stream live operational logs from Klever-Go nodes, undermining operator visibility and disclosing sensitive runtime information.

Affected Products

Klever-Go blockchain node software prior to version 1.7.20
Deployments exposing the default GET /log WebSocket route
Seednode components using the default api.yaml configuration

Discovery Timeline

2026-09-23 - CVE-2026-86064 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86064

Vulnerability Analysis

CVE-2026-86064 is an information exposure and unauthenticated configuration mutation flaw classified as [CWE-200]. The Klever-Go API server registers a WebSocket route at /log through network/api/api.go, and the default config/node/api.yaml marks the route as open. Any remote client that can reach the API port can complete the WebSocket handshake without credentials.

Once connected, the first client message is decoded in network/api/logs/logSender.go as a logger Profile object. The code then calls Profile.Apply, mutating the process-wide logger configuration. The same socket is registered as a log observer, so the attacker receives the live log stream produced under the new settings.

This combination enables three concurrent effects: attackers can suppress normal logs to hide follow-on activity, raise verbosity to expose operational details, and exfiltrate live logs that may contain transaction data, peer identifiers, or internal state.

Root Cause

The route registration lacked an authentication check, and the WebSocket handler trusted the first inbound message as an authoritative logger profile. There was no separation between read-only log observation and privileged logger mutation, so any connected client could reconfigure the node.

Attack Vector

Exploitation requires network reachability to the Klever-Go API port. No credentials, user interaction, or prior foothold are required. An attacker sends a WebSocket upgrade request to /log, then transmits a crafted Profile payload that adjusts log levels and pattern formatting before consuming the returned log stream for as long as the socket remains open.

// Security patch excerpt from config/api.go — adds route capability checks
// Source: https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2

Secured bool   `yaml:"secured"`

// IsRouteEnabled reports whether the named route in the given API package exists and is open.
func (c APIRoutesConfig) IsRouteEnabled(pkg, name string) bool {
    return c.routeHasFlag(pkg, name, func(r RouteConfig) bool { return r.Open })
}

// IsRouteSecured reports whether the named route in the given API package exists and is secured.
func (c APIRoutesConfig) IsRouteSecured(pkg, name string) bool {
    return c.routeHasFlag(pkg, name, func(r RouteConfig) bool { return r.Secured })
}

func (c APIRoutesConfig) routeHasFlag(pkg, name string, hasFlag func(RouteConfig) bool) bool {
    pkgConfig, ok := c.APIPackages[pkg]
    if !ok {
        return false
    }

    for _, route := range pkgConfig.Routes {
        if route.Name == name && hasFlag(route) {
            return true
        }
    }

    return false
}

The patch introduces IsRouteEnabled and IsRouteSecured helpers so the API layer can enforce authentication requirements per route before accepting connections. See the GitHub Security Advisory GHSA-9v8p-frvj-2pcm for full remediation detail.

Detection Methods for CVE-2026-86064

Indicators of Compromise

Unexpected WebSocket upgrade requests to the /log path on Klever-Go API ports from external or unauthorized sources.
Sudden changes in log verbosity, log format, or log volume on Klever-Go nodes without a corresponding operator action.
Long-lived outbound-terminated connections on the API port originating from unknown clients.

Detection Strategies

Inspect reverse-proxy and node access logs for GET /log requests carrying Upgrade: websocket headers from non-management networks.
Baseline normal logger Profile values and alert when live logger levels or patterns diverge from the deployed configuration.
Correlate WebSocket connection events with subsequent logger configuration changes to identify unauthenticated mutation attempts.

Monitoring Recommendations

Forward Klever-Go node logs and API access logs to a centralized analytics platform for behavioral analysis.
Alert on any successful WebSocket handshake to /log prior to upgrading to version 1.7.20.
Monitor for anomalous drops in expected log message rates, which may indicate attacker-driven log suppression.

How to Mitigate CVE-2026-86064

Immediate Actions Required

Upgrade Klever-Go to version 1.7.20 or later on all node and seednode deployments.
Restrict network access to the Klever-Go API port so only trusted management networks can reach /log.
Audit config/node/api.yaml and config/seednode/api.yaml to confirm the /log route is marked as secured.

Patch Information

The fix is available in Klever-Go v1.7.20. The remediation is implemented in commit a2740c9 and discussed in pull request #74. The patch adds configurationAPIFile support for seednode, introduces per-route IsRouteEnabled and IsRouteSecured checks, and requires authentication for /log while removing unauthenticated logger mutation.

Workarounds

Place the Klever-Go API behind a reverse proxy that enforces authentication and rejects unauthenticated Upgrade: websocket requests to /log.
Block ingress to the API port from untrusted networks using host firewall or cloud security group rules until the upgrade is applied.
Disable the /log route in api.yaml if the deployment does not require remote log streaming.

bash

# Example: restrict Klever-Go API access to a management subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Verify installed Klever-Go version is 1.7.20 or later
klever-go --version