klever-io klever-go up to 1.7.16 Host-core paths runtime runtime.ReadOnly privileges management

Summaryinfo

A vulnerability identified as problematic has been detected in klever-io klever-go up to 1.7.16. The impacted element is the function runtime.ReadOnly of the file runtime of the component Host-core paths. The manipulation leads to privileges management. This vulnerability is uniquely identified as CVE-2026-46403. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in klever-io klever-go up to 1.7.16 and classified as problematic. This issue affects the function runtime.ReadOnly of the file runtime of the component Host-core paths. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is integrity, and availability. The summary by CVE is:

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-46403 since 05/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.7.17 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• klever-io

Name

• klever-go

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5
• 1.7.6
• 1.7.7
• 1.7.8
• 1.7.9
• 1.7.10
• 1.7.11
• 1.7.12
• 1.7.13
• 1.7.14
• 1.7.15
• 1.7.16

Website

• Product: https://github.com/klever-io/klever-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion