EUVD-2026-374366

fkie_cve-2026-86064

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

GHSA-9v8p-frvj-2pcm — Klever-Go: /log controls global node logging

Affected: Go: github.com/klever-io/klever-go

An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to `*:NONE`, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.

This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.

## Vulnerability details

### Affected code

- Route exposed by default in `config/node/api.yaml` - Route registration in `network/api/api.go` - Unauthenticated upgrade in `network/api/api.go` - First client message is parsed as a logger profile and applied globally in `network/api/logs/logSender.go` - Global logger mutation happens in dependency `github.com/klever-io/klever-go-logger`, `profile.go`, `Apply()`

### Root cause

`/log` is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger `Profile`. That profile is then applied process-wide through `profile.Apply()`, which changes global log level patterns and output formatting options for the whole node.

After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the r…

Most recent entries from all

EUVD-2026-374366

fkie_cve-2026-86064

GHSA-9v8p-frvj-2pcm — Klever-Go: /log controls global node logging