EUVD-2026-85647
GHSA-7c7c-373r-gfjj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote low-priv transaction (PR:L) with no interaction; vulnerable blockchain node poisons a separate Elasticsearch system (S:C); no data disclosure (C:N) but document forgery/deletion (I:H) and batch rejection (A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.
AnalysisAI
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk request bodies without JSON escaping, allowing an attacker who can submit a SetAccountName transaction to inject forged bulk actions that create, overwrite, or delete documents in any index the indexer can write to. Because the name is stored in consensus account state, the poisoned value is replayed by new and historical indexers, and no access to the indexing host or the Elasticsearch port is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to submit a SetAccountName transaction (any low-privilege on-chain account, hence PR:L) whose name contains quotes, backslashes, or newlines - accepted because only UTF-8 validity and length are checked - and the target deployment must run an Elasticsearch indexer (indexer/common.go serializedDataForUpdateAccounts) that processes account state into _bulk requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority integrity flaw rather than a CVSS-inflated non-issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade every Klever-Go node that runs the Elasticsearch indexer to version 1.7.20, which escapes account names via converters.JsonEscape in indexer/common.go before they are embedded in _bulk bodies; the exact fix is in commits f00366768b24be18fa7ae9de2e1905caa8b350af and f54ea730cc80a3ba4f906586a7d221b281548190 and the release is https://github.com/klever-io/klever-go/releases/tag/v1.7.20, with details in https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments running Klever-Go indexers with Elasticsearch output and confirm the running version, since only the indexer path is exposed; apply restrictive Elasticsearch credentials scoped to the minimum set of indices the indexer actually requires, enable Elasticsearch audit logging, and take a verified snapshot of current indices so tampering can be detected and rolled back. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
zot container registry versions prior to 2.1.18 mis-map the HTTP DELETE method to the "push" scope action in its bearer
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today