Is CVE-2026-82406 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82406 being exploited in the wild.

How severe is CVE-2026-82406?

High severity, with a CVSS score of 4, published 23 September 2026.

Which products and versions are affected?

github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.

Is there a fix for CVE-2026-82406?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82406 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82406?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82406: Klever-Go marketplace Buy missing IsClaimed guard

Q: Is there a fix for CVE-2026-82406?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-82406 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-82406?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82406 · Severity: high · CVSS 4 · Published 2026-09-23

Klever-Go's marketplace is a native cryptocurrency exchange for trading NFTs. An attacker can trick victims into bidding on already-settled (claimed) orders by exploiting a missing validation in the Buy function. Victims lose their entire bid with no way to recover it or cancel—the attacker keeps both the NFT and siphons cryptocurrency from subsequent bidders.

Technologies: github.com/klever-io/klever-go (Go). Vendors: Go.

Quick answers

Is CVE-2026-82406 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82406 being exploited in the wild.
How severe is CVE-2026-82406?: High severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?: github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.
Is there a fix for CVE-2026-82406?: Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82406 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82406?: Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later
```
go get github.com/klever-io/klever-go@v1.7.20
```

Technical details

The marketplace Buy function lacks an IsClaimed guard present in Claim and CancelOrder. When a seller accepts a resting-bid auction early via Claim, the order is marked IsClaimed but EndTime is not reset and the order is not deleted, creating a "zombie" order that appears live but is already settled. An attacker can exploit this by creating a resting auction, accepting it early (keeping the NFT), then waiting for victims to bid on the zombie order. The Buy function has no IsClaimed check, so it accepts the victim's bid, debits the victim's balance, refunds the prior (attacker-controlled) bidder, and records the victim as CurrentBidder. The victim then cannot Claim (blocked by IsClaimed) or CancelOrder (blocked by IsClaimed), permanently losing their funds. The attack is permissionless and repeatable, enabling theft via fund destruction and Sybil bidding.

Affected products

Klever Klever-Go prior to fix

Identifiers

CVE-2026-82406
GHSA-26r5-4mm2-px5c
GO-2026-6584

Timeline

2026-09-23: disclosed
2026-09-23: advisory: GHSA-26r5-4mm2-px5c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.