CVE-2026-58262

Received Received - Intake

Header Signature Verification Bypass in Klever-Go

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS aggregate-signature check, so a malicious or compromised block producer can set them to reach the required quorum while gathering fewer genuine validator signatures than the protocol demands. As a result, nodes that import or intercept the header accept it as correctly signed without a real two-thirds quorum, weakening consensus safety and undermining finality. This issue is fixed in version 1.7.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-58262

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	1.7.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Klever-Go, a Go implementation of the Klever blockchain protocol. Prior to version 1.7.20, the header signature verification incorrectly counts unused padding bits in the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not represent actual validators and are ignored during BLS aggregate-signature checks. A malicious block producer can exploit this to meet quorum requirements with fewer genuine validator signatures than required, weakening consensus safety and undermining finality.

Detection Guidance

This vulnerability cannot be directly detected via commands as it involves a logic flaw in signature verification. Upgrade to Klever-Go version 1.7.20 or later to address the issue.

Impact Analysis

If you run a node using a vulnerable version of Klever-Go (before 1.7.20), you may accept blocks that appear correctly signed but lack the required two-thirds validator quorum. This could lead to incorrect transaction validation, potential double-spending, or chain forks, compromising the integrity and security of the blockchain you rely on.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to blockchain consensus mechanisms rather than data protection or privacy requirements.

Mitigation Strategies

Upgrade Klever-Go to version 1.7.20 or later to address the header signature verification issue.

Hi! I’m here to help you understand CVE-2026-58262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70