CVE-2026-82407

Deferred Deferred - Pending Action

Klever-Go BLS Public Key Validation Flaw Enables Consensus Halting

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-82407

EUVD

EUVD-2026-85576

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	to 1.7.20 (inc)
klever	klever-go	1.7.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in Klever-Go blockchain software (versions before 1.7.20) involves insufficient validation of BLS public keys during validator registration and updates. Attackers can submit malformed BLS keys that bypass checks, leading to consensus failures when these validators are selected. The issue occurs because runtime validator updates do not validate key properties like curve membership or non-zero values, unlike genesis validation which already performs these checks.

Detection Guidance

To detect this vulnerability, monitor for validators with malformed BLS public keys in your Klever-Go network. Check validator registration logs for keys that bypass validation checks. Use the klever-go CLI to inspect validator keys and ensure they meet BLS12-381 G2 curve requirements. Look for repeated missed consensus rounds or throughput degradation as indicators of exploitation.

Impact Analysis

This vulnerability can cause denial-of-service conditions by disrupting consensus. When a validator with a malformed key is selected, the system fails to deserialize the key during block finalization, canceling consensus rounds and degrading throughput. In small networks where the consensus group equals the validator set, this can halt the entire chain completely. The attack requires minimal stake and can be repeated indefinitely.

Compliance Impact

This vulnerability primarily impacts blockchain consensus mechanisms rather than direct data protection compliance like GDPR or HIPAA. The issue allows denial-of-service attacks that disrupt network operations, which could indirectly affect availability of blockchain-based systems storing regulated data. However, no evidence suggests this vulnerability directly violates GDPR or HIPAA requirements for data security or privacy.

Mitigation Strategies

Upgrade to Klever-Go version 1.7.20 or later to enforce strict BLS key validation. Ensure all validator keys are validated for curve membership, prime-order subgroup, and non-zero values during registration and updates. Monitor consensus rounds for failures and revoke or replace any validators with invalid keys. Consider requiring proof-of-possession for key ownership.

Hi! I’m here to help you understand CVE-2026-82407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70