CVE-2026-82409High· 8.4▾ MidnightPoC availableKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request wi…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 46.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
Exploit / PoC code exists
0.3%
0.3% → 0.3%
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/klever-io/klever-go <= 1.7.19Patched in:
github.com/klever-io/klever-go 1.7.20Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82406High· 7.1Klever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-82407High· 7.0Klever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-86064High· 8.6Klever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-86065High· 7.5Klever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-82405High· 8.7Klever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-49343Medium· 5.9Klever-Go is the Go implementation of the Klever blockchain protocol