{"cve":"CVE-2026-86064","nvd":{"published":"2026-09-23T20:17:19.960","modified":"2026-09-23T20:17:20.117","status":"Deferred","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","score":8.6},"cwes":["CWE-200","CWE-306"],"references":["https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2","https://github.com/klever-io/klever-go/pull/74","https://github.com/klever-io/klever-go/releases/tag/v1.7.20","https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm","https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-86064","score":0.00577,"percentile":0.47582,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-9v8p-frvj-2pcm","url":"https://osv.dev/vulnerability/GHSA-9v8p-frvj-2pcm","summary":"Klever-Go: /log controls global node logging","modified":"2026-10-01T20:56:03.184933718Z","packages":[{"ecosystem":"Go","name":"github.com/klever-io/klever-go","purl":"pkg:golang/github.com/klever-io/klever-go","ranges":["<1.7.20"],"fixed":["1.7.20"]}]},{"id":"GO-2026-6583","url":"https://osv.dev/vulnerability/GO-2026-6583","summary":"Klever-Go: /log controls global node logging in github.com/klever-io/klever-go","modified":"2026-10-01T20:45:14.982988948Z","packages":[{"ecosystem":"Go","name":"github.com/klever-io/klever-go","purl":"pkg:golang/github.com/klever-io/klever-go","ranges":["<1.7.20"],"fixed":["1.7.20"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}