CVE-2026-82405

Deferred Deferred - Pending Action

Permission Escalation in Klever-Go Blockchain

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-82405

EUVD

EUVD-2026-85648

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	to 1.7.20 (inc)
klever	klever-go	to 1.7.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a critical account takeover flaw in the Klever blockchain's Go implementation. It exists in the KleverUpdateAccountPermission function, which incorrectly checks authorization using the attacker-controlled RecipientAddr instead of the authenticated CallerAddr. This allows an attacker to replace a victim's account permissions with their own, gaining full control without needing the victim's key or signature.

Detection Guidance

To detect this vulnerability, check if your Klever-Go version is below 1.7.20. Run: klever-go version. If the output shows a version older than 1.7.20, the system is vulnerable. Additionally, monitor for unauthorized permission changes in accounts with stored permissions.

Impact Analysis

If you are a user with configured permissions in the Klever blockchain, an attacker could exploit this to steal your assets or lock you out of your account permanently. The attack requires no cryptographic signatures from you and works by manipulating transaction inputs via a malicious smart contract.

Compliance Impact

This vulnerability could lead to unauthorized access or control of user accounts, potentially violating data protection requirements under GDPR (e.g., unauthorized processing of personal data) and HIPAA (e.g., unauthorized access to protected health information). The lack of proper authorization checks may result in non-compliance with security and privacy controls mandated by these regulations.

Mitigation Strategies

Upgrade to Klever-Go version 1.7.20 or later to patch the vulnerability. Ensure all nodes are updated and the fork flag fixAuditChangesV3 is configured correctly to avoid consensus issues.

Hi! I’m here to help you understand CVE-2026-82405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70