CVE-2026-46403
Received Received - Intake

Klever-Go Read-Only Bypass via Contract Deletion

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-46403

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
klever klever-go to 1.7.17 (exc)
klever klever-go 1.7.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Klever-Go allows read-only execution to perform state-changing operations like contract deletion or upgrades. The KVM's read-only mode fails to enforce restrictions in indirect paths, letting a contract invoked via read-only execution trigger production delete or upgrade hooks if it owns the target contract. This breaks the isolation expected from read-only calls, enabling unauthorized state mutations.

Detection Guidance

Detecting this vulnerability requires checking the Klever-Go version in use. Run `klever-go version` or inspect the binary metadata to verify if the installed version is below 1.7.17. Additionally, monitor for unexpected contract deletions or upgrades in read-only execution contexts.

Impact Analysis

An attacker could exploit this to delete or upgrade contracts they own without proper authorization, disrupting workflows that rely on read-only calls for non-mutating operations. The attack requires satisfying contract-level preconditions but no special privileges or user interaction, with medium severity (CVSS 6.3).

Compliance Impact

The vulnerability allows unauthorized state changes (contract deletion/upgrades) during read-only execution, which could lead to data integrity violations. This may impact compliance with regulations requiring strict data access controls and auditability, such as GDPR's integrity principle or HIPAA's integrity and availability requirements.

Mitigation Strategies
  • Upgrade Klever-Go to version 1.7.17 or later immediately to address the read-only execution bypass.
  • Review and audit contracts that may have been deleted or upgraded unexpectedly due to this vulnerability.
  • Monitor network activity for unauthorized state changes, particularly in contracts owned by other entities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart