EUVD-2026-85573
GHSA-26r5-4mm2-px5c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote on-chain exploitation needing a funded marketplace account (PR:L), deterministic workflow (AC:L); integrity/fund-loss impact only (I:H), no confidentiality or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.
AnalysisAI
Improper enforcement of the marketplace settlement workflow in Klever-Go prior to 1.7.20 lets an authenticated seller settle a resting-bid NFT auction through the Claim seller-accept branch while leaving the claimed order loadable with a future EndTime and stale CurrentBid/CurrentBidder values. A later bidder can then submit a higher bid, be debited, and trigger a refund to the previous bidder even though the NFT has already been delivered, while Claim and CancelOrder both reject that bidder because IsClaimed is true - leaving them unable to obtain the NFT or recover their funds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an on-chain account with funds to participate in the Klever-Go native marketplace: the attacker must be a seller who lists an NFT auction and then invokes the Claim seller-accept branch to settle a resting-bid auction, exploiting that market.go Buy never checks IsClaimed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine business-logic/integrity flaw (CWE-841, improper enforcement of behavioral workflow) in Klever-Go's native NFT marketplace, not a confidentiality issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 1.7.20 - upgrade all Klever-Go nodes and supernodes to v1.7.20 (https://github.com/klever-io/klever-go/releases/tag/v1.7.20), which adds the missing IsClaimed validation in the marketplace Buy path; the change is also visible upstream via PR https://github.com/klever-io/klever-go/pull/16 and commit https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2, with the official advisory at https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Klever-Go deployment and confirm which run versions prior to 1.7.20; treat the structured patch field and the technical description as conflicting (the description states a vendor fix is available in 1.7.20) and confirm the fix status directly with the vendor or advisory before communicating to stakeholders; if 1.7.20 is confirmed available, begin emergency upgrade of internet-facing marketplace nodes and freeze or manually review any auction settlements processed since the affected version entered production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re
Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Share
External POC / Exploit Code
Leaving vuln.today