Is CVE-2026-46403 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46403 being exploited in the wild.

How severe is CVE-2026-46403?

Medium severity, with a CVSS score of 6.3, published 21 July 2026.

Which products and versions are affected?

github.com/klever-io/klever-go (Go) < 1.7.17, SEMVER:introduced=0,fixed=1.7.17; Klever.io Klever-Go < 1.7.17.

Is there a fix for CVE-2026-46403?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46403 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46403?

Check whether you run github.com/klever-io/klever-go (Go) or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46403: Klever-io Klever-Go protection mechanism failure in KVM read-only execution

Q: Is there a fix for CVE-2026-46403?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46403 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46403?

Check whether you run github.com/klever-io/klever-go (Go) or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46403 · Severity: medium · CVSS 6.3 · Published 2026-07-21

Klever-Go is the software implementation of the Klever blockchain protocol. A vulnerability in its virtual machine (KVM) allows smart contracts to bypass "read-only" restrictions, which are intended to prevent a contract from making permanent changes to the blockchain. In practice, an attacker could use a read-only call to unexpectedly delete or upgrade a smart contract they own, breaking the security isolation between different blockchain operations and potentially leading to unauthorized state changes.

Technologies: github.com/klever-io/klever-go (Go), Klever.io Klever-Go. Vendors: Go, Klever.io.

Quick answers

Is CVE-2026-46403 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46403 being exploited in the wild.
How severe is CVE-2026-46403?: Medium severity, with a CVSS score of 6.3, published 21 July 2026.
Which products and versions are affected?: github.com/klever-io/klever-go (Go) < 1.7.17, SEMVER:introduced=0,fixed=1.7.17; Klever.io Klever-Go < 1.7.17.
Is there a fix for CVE-2026-46403?: Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46403 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46403?: Check whether you run github.com/klever-io/klever-go (Go) or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/klever-io/klever-go (Go): upgrade to 1.7.17 or later
```
go get github.com/klever-io/klever-go@v1.7.17
```

Technical details

A protection mechanism failure (CWE-693) exists in Klever-Go's KVM implementation prior to version 1.7.17. While the `ExecuteReadOnlyWithTypedArguments` hook correctly sets the runtime state to read-only, the host-core paths for contract deletion and upgrading fail to check this `runtime.ReadOnly()` flag. An attacker can exploit this by reaching a contract through a read-only execution context and then calling the production delete or upgrade hooks. This allows the contract to append addresses to `vmOutput.DeletedAccounts`, which the smart contract processor subsequently processes as permanent state changes. The vulnerability is fixed in v1.7.17 by enforcing the read-only invariant within the delete and upgrade dispatch paths.

Affected products

Klever-io Klever-Go < 1.7.17

Identifiers

CVE-2026-46403
GHSA-jc6w-wmfc-fh33
GO-2026-5461

Timeline

2026-05-05: other: Internal fix commit for read-only invariant enforcement
2026-05-19: advisory: GitHub Security Advisory GHSA-jc6w-wmfc-fh33 published
2026-07-21: disclosed: CVE-2026-46403 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.