Klever-IO Klever-Go up to 1.7.19 Indexer indexer/common.go serializedDataForUpdateAccounts Name injection

Summaryinfo

A vulnerability classified as problematic has been found in Klever-IO Klever-Go up to 1.7.19. This affects the function serializedDataForUpdateAccounts of the file indexer/common.go of the component Indexer. Performing a manipulation of the argument Name results in injection. This vulnerability is identified as CVE-2026-82409. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Klever-IO Klever-Go up to 1.7.19. It has been classified as problematic. This affects the function serializedDataForUpdateAccounts of the file indexer/common.go of the component Indexer. The manipulation of the argument Name with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on integrity, and availability. The summary by CVE is:

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-82409 since 08/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

Upgrading to version 1.7.20 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Klever-IO

Name

• Klever-Go

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5
• 1.7.6
• 1.7.7
• 1.7.8
• 1.7.9
• 1.7.10
• 1.7.11
• 1.7.12
• 1.7.13
• 1.7.14
• 1.7.15
• 1.7.16
• 1.7.17
• 1.7.18
• 1.7.19

Website

• Product: https://github.com/klever-io/klever-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion