CVE-2026-86064

Deferred Deferred - Pending Action

Klever-Go WebSocket Log Configuration Authentication Bypass

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-86064

EUVD

EUVD-2026-85574

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	1.7.20
klever	klever-go	to 1.7.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-86064 is a high-severity vulnerability in Klever Go blockchain node software (versions <= 1.7.19). It allows unauthenticated attackers to manipulate the node's global logging configuration via the public WebSocket endpoint /log. By sending a specially crafted logger profile as the first WebSocket message, an attacker can mute all node logs, increase verbosity, or modify logging settings. The vulnerability exists because the /log endpoint is enabled by default without authentication and applies changes globally to the entire node process.

Detection Guidance

To detect this vulnerability, check if your Klever Go node (version <= 1.7.19) exposes the unauthenticated /log WebSocket endpoint. Use netstat or ss to verify if port 80 or 443 is listening for WebSocket connections. Test the endpoint with curl or websocat by connecting to ws://<node-ip>:<port>/log and sending a logger profile as the first message. If logs can be manipulated or live logs are accessible without authentication, the system is vulnerable.

Impact Analysis

This vulnerability allows remote attackers to suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. Attackers can mute logs entirely (e.g., setting log level to *:NONE), flood logs with excessive data (e.g., *:TRACE), or modify logging settings to hide critical events. This can disrupt node operations, expose sensitive information in logs, and interfere with incident response efforts.

Mitigation Strategies

Upgrade Klever Go to version 1.7.20 or later to patch the vulnerability.
Disable the /log WebSocket endpoint in the API configuration (config/node/api.yaml) by setting open: false.
Enable authentication for the /log endpoint by setting secured: true in the API configuration.
Restart the Klever Go node to apply changes and verify the endpoint is no longer accessible without credentials.

Hi! I’m here to help you understand CVE-2026-86064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70