CVE-2026-82406

Deferred Deferred - Pending Action

Klever-Go Marketplace Bid Manipulation via IsClaimed Check Bypass

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-82406

EUVD

EUVD-2026-85573

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	1.7.20
klever	klever_go	to 1.7.20 (exc)
klever	klever_go	1.7.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability in Klever-Go's marketplace function Buy allows a seller to prematurely settle an auction via the Claim function, leaving the order in a 'zombie' state where IsClaimed is true but EndTime remains in the future. A later bidder can then place a bid, be debited, and lose funds because the order appears active but cannot be canceled or refunded due to the IsClaimed guard in Claim and CancelOrder functions.

Detection Guidance

To detect this vulnerability, check if your Klever Go version is below 1.7.20. Run: klever-go version. If below 1.7.20, the system is vulnerable. Additionally, monitor marketplace transactions for zombie orders where IsClaimed is true but EndTime is in the future. Check logs for Buy transactions on such orders.

Impact Analysis

If you are a user placing bids on the Klever marketplace, this vulnerability could cause you to lose funds. You might be debited for a bid on an order that appears active but is already claimed, leaving you with no NFT and no way to recover your money. The attack is repeatable and permissionless, meaning anyone can exploit it.

Compliance Impact

This vulnerability could lead to financial fraud and fund loss, which may violate data protection principles under GDPR (e.g., integrity and confidentiality of personal data) and HIPAA (e.g., safeguarding financial transactions involving health-related data). The inability to recover funds for victims may also conflict with accountability and security requirements in these regulations.

Mitigation Strategies

Upgrade Klever Go to version 1.7.20 or later to patch the vulnerability.
Configure the fork flag fixAuditChangesV3 correctly to activate the consensus-visible rejection of vulnerable orders.
Monitor marketplace transactions for suspicious activity involving zombie orders or unexpected fund debits.

Hi! I’m here to help you understand CVE-2026-82406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70