CVE-2026-58262 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS aggregate-signature check, so a malicious or compromised block producer can set them to reach the required quorum while gathering fewer genuine validator signatures than the protocol demands. As a result, nodes that import or intercept the header accept it as correctly signed without a real two-thirds quorum, weakening consensus safety and undermining finality. This issue is fixed in version 1.7.20.
A vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol, prior to version 1.7.20, allows a malicious block producer to manipulate header signature verification. The issue arises because the verification process counts unused padding bits in the PubKeysBitmap towards the required two-thirds validator quorum. These padding bits, which do not correspond to any actual validator, are ignored in the BLS aggregate-signature validation. As a result, a block producer can artificially inflate the quorum count by setting these padding bits, leading to the acceptance of a block without the necessary genuine validator signatures. This vulnerability undermines consensus safety and finality guarantees, as nodes that import or intercept the header may accept it as correctly signed without a real two-thirds quorum.
Users should update to Klever-Go version 1.7.20 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/commit/a11cb28e495e608d8034dbe83a91e89d0c68e0f7 | [email protected] | Source CodeVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-f9h7-4mmq-vgcq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | < 1.7.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |