CVE-2026-82407 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.
A vulnerability exists in Klever-Go's validator registration process, where the BLS public key is accepted without proper validation. This issue is present in versions prior to 1.7.20. The lack of validation allows malformed keys to be registered, which can disrupt the consensus process. When a validator with an invalid key is elected, it causes a failure in the signature verification process, leading to missed rounds and potential halts in network activity, especially in smaller networks.
This vulnerability has been fixed in Klever-Go version 1.7.20, which includes proper validation of BLS public keys during the registration and update processes. Users should upgrade to this version and ensure that their node's configuration is set to the correct epoch for the network.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff | [email protected] | Source CodeVendor |
| https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f | [email protected] | Source CodeVendor |
| https://github.com/klever-io/klever-go/releases/tag/v1.7.20 | [email protected] | Release NotesVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | <= v1.7.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | New CVE Received | [email protected] |
| Sep 23, 2026 | CVE Modified | CISA-ADP |