{"id":"CVE-2026-82405","kind":"vulnerability","aliases":["CVE-2026-82405","GHSA-97cv-x867-6xhm","GO-2026-6582"],"related":[],"title":"Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.","summary":"Klever-Go, the Go implementation of the Klever blockchain protocol, has an authorization bug in its KleverUpdateAccountPermission built-in: it checks the attacker-controlled RecipientAddr instead of the authenticated CallerAddr. An attacker-controlled contract can replace a victim account's entire permission set without the victim's key, enabling asset theft or permanent lockout.","severity":"high","cvss":8.7,"epss":0.0026,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/klever-io/klever-go","fixed":["1.7.20"],"affected":"< 1.7.20","ecosystem":"go"}],"ecosystems":["go"],"tags":["blockchain","go","klever","klever-go","package"],"not_affected_if":["accounts-without-stored-permissions","native-transaction-path-only"],"how_to_check":"Check whether go.mod pins github.com/klever-io/klever-go below 1.7.20 (grep klever-go go.mod).","fix":"Upgrade github.com/klever-io/klever-go to 1.7.20 or later.","status":"open","published_at":"2026-09-23T20:17:16+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:51:42+00:00","updated_at":"2026-10-23T19:51:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:51:42Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/klever-io/klever-go to 1.7.20 or later.\nunknown","summary":"Klever-Go, the Go implementation of the Klever blockchain protocol, has an authorization bug in its KleverUpdateAccountPermission built-in: it checks the attacker-controlled RecipientAddr instead of the authenticated CallerAddr. An attacker-controlled contract can replace a victim account's entire permission set without the victim's key, enabling asset theft or permanent lockout.","category":"package","who_cares":["go","klever-go","blockchain","klever"],"confidence":0.8,"analyst_note":"Confirm the exact check command and whether any downstream node or contract deployment embeds the module; see GO-2026-6582 at https://pkg.go.dev/vuln/GO-2026-6582.","how_to_check":"Check whether go.mod pins github.com/klever-io/klever-go below 1.7.20 (grep klever-go go.mod).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["accounts-without-stored-permissions","native-transaction-path-only"],"severity_if_unknown":"high"},"cost_usd":0.000436,"input_tokens":2344,"output_tokens":403,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':23A,31A,34A '-6582':32A '-82405':24A,35A '/klever-io/klever-go':21A,38A '1.7.20':118C,216C '6xhm':29A '97cv':27A 'accept':160C 'account':4A,88B,129C,151C,198C 'affect':209C 'asset':99B,187C 'attack':10A,71B,81B,135C,144C,182C 'attacker-control':9A,70B,80B,134C,143C 'attacker-suppli':181C 'authent':16A,77B,140C 'author':7A,59B,124C,169C 'blockchain':39B,55B,114C 'bug':60B 'built':65B,122C 'built-in':64B,121C 'caller':17A 'calleraddr':78B 'check':68B,133C 'choos':148C 'configur':153C 'contract':83B,146C 'contracthasvalidpermiss':158C 'control':11A,72B,82B,136C,145C 'cve':22A,33A 'default':164C 'enabl':98B,186C 'entir':90B,177C 'fix':213C 'ghsa':26A 'ghsa-97cv-x867-6xhm':25A 'github.com':20A,37A 'github.com/klever-io/klever-go':19A,36A 'go':3A,30A,40B,44B,48B,50B,106C,109C 'implement':51B,110C 'instead':13A,74B,138C 'issu':211C 'key':97B,195C 'klever':2A,41B,43B,47B,54B,105C,113C 'klever-go':1A,42B,46B,104C 'kleverupdateaccountpermiss':6A,63B,120C 'lockout':103B,191C 'nativ':204C 'owner':184C 'packag':45B 'path':206C 'perman':102B,190C 'permiss':91B,131C,154C,178C,185C,201C 'prior':116C 'protocol':56B,115C 'recipientaddr':12A,73B,156C 'replac':85B,125C,173C 'self':166C 'self-sign':165C 'set':92B,179C 'signatur':197C 'signer':167C 'store':200C 'suppli':183C 'takeov':5A 'target':128C 'theft':100B,188C 'transact':205C 'updatepermiss':170C 'version':215C 'victim':87B,95B,150C,162C,175C,194C 'vminput.calleraddr':141C 'vminput.recipientaddr':137C 'without':93B,192C,199C 'x867':28A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-23T20:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6582","url":"https://pkg.go.dev/vuln/GO-2026-6582","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-82405","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82405","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-82405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82405","severity":null,"published_at":"2026-09-23T20:17:16+00:00","modified_at":"2026-09-24T16:17:12+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}