# CVE-2026-46403: Klever-io Klever-Go protection mechanism failure in KVM read-only execution

Source: https://junglewise.ai/threats/cve-2026-46403-klever-io-klever-go-protection-mechanism-failure-in-kvm-read-only  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-46403 · Severity: medium · CVSS 6.3 · Published 2026-07-21

Klever-Go is the software implementation of the Klever blockchain protocol. A vulnerability in its virtual machine (KVM) allows smart contracts to bypass "read-only" restrictions, which are intended to prevent a contract from making permanent changes to the blockchain. In practice, an attacker could use a read-only call to unexpectedly delete or upgrade a smart contract they own, breaking the security isolation between different blockchain operations and potentially leading to unauthorized state changes.

Technologies: [github.com/klever-io/klever-go (Go)](https://junglewise.ai/threats/technologies/github-com-klever-io-klever-go), [Klever.io Klever-Go](https://junglewise.ai/threats/technologies/klever-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Klever.io](https://junglewise.ai/threats/vendors/klever-io).

## Quick answers

**Is CVE-2026-46403 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46403 being exploited in the wild.

**How severe is CVE-2026-46403?** Medium severity, with a CVSS score of 6.3, published 21 July 2026.

**Which products and versions are affected?** github.com/klever-io/klever-go (Go) < 1.7.17, SEMVER:introduced=0,fixed=1.7.17; Klever.io Klever-Go < 1.7.17.

**Is there a fix for CVE-2026-46403?** Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46403 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46403?** Check whether you run github.com/klever-io/klever-go (Go) or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/klever-io/klever-go (Go): upgrade to 1.7.17 or later

  ```sh
  go get github.com/klever-io/klever-go@v1.7.17
  ```


## Technical details

A protection mechanism failure (CWE-693) exists in Klever-Go's KVM implementation prior to version 1.7.17. While the `ExecuteReadOnlyWithTypedArguments` hook correctly sets the runtime state to read-only, the host-core paths for contract deletion and upgrading fail to check this `runtime.ReadOnly()` flag. An attacker can exploit this by reaching a contract through a read-only execution context and then calling the production delete or upgrade hooks. This allows the contract to append addresses to `vmOutput.DeletedAccounts`, which the smart contract processor subsequently processes as permanent state changes. The vulnerability is fixed in v1.7.17 by enforcing the read-only invariant within the delete and upgrade dispatch paths.

## Affected products

- Klever-io Klever-Go < 1.7.17

## Identifiers

- CVE-2026-46403
- GHSA-jc6w-wmfc-fh33
- GO-2026-5461

## Timeline

- 2026-05-05: other: Internal fix commit for read-only invariant enforcement
- 2026-05-19: advisory: GitHub Security Advisory GHSA-jc6w-wmfc-fh33 published
- 2026-07-21: disclosed: CVE-2026-46403 published to NVD

## References

- [https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862](https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862)
- [https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef](https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef)
- [https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33](https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33)

## Related threats

- [Klever-Go unauthenticated WebSocket /subscribe remote DoS](https://junglewise.ai/threats/cve-2026-86065-klever-go-unauthenticated-websocket-subscribe-remote-dos)
- [Klever-Go /log endpoint unauthenticated logging configuration manipulation](https://junglewise.ai/threats/cve-2026-86064-klever-go-log-endpoint-unauthenticated-logging-configuration)
- [Klever-Go Elasticsearch injection via account name](https://junglewise.ai/threats/cve-2026-82409-klever-go-elasticsearch-injection-via-account-name)
- [Klever-Go BLS public key validation bypass in validator registration](https://junglewise.ai/threats/cve-2026-82407-klever-go-bls-public-key-validation-bypass-in-validator)
- [Klever-Go marketplace Buy missing IsClaimed guard](https://junglewise.ai/threats/cve-2026-82406-klever-go-marketplace-buy-missing-isclaimed-guard)