# CVE-2026-82406: Klever-Go marketplace Buy missing IsClaimed guard

Source: https://junglewise.ai/threats/cve-2026-82406-klever-go-marketplace-buy-missing-isclaimed-guard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82406 · Severity: high · CVSS 4 · Published 2026-09-23

Klever-Go's marketplace is a native cryptocurrency exchange for trading NFTs. An attacker can trick victims into bidding on already-settled (claimed) orders by exploiting a missing validation in the Buy function. Victims lose their entire bid with no way to recover it or cancel—the attacker keeps both the NFT and siphons cryptocurrency from subsequent bidders.

Technologies: [github.com/klever-io/klever-go (Go)](https://junglewise.ai/threats/technologies/github-com-klever-io-klever-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-82406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82406 being exploited in the wild.

**How severe is CVE-2026-82406?** High severity, with a CVSS score of 4, published 23 September 2026.

**Which products and versions are affected?** github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.

**Is there a fix for CVE-2026-82406?** Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82406 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82406?** Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later

  ```sh
  go get github.com/klever-io/klever-go@v1.7.20
  ```


## Technical details

The marketplace Buy function lacks an IsClaimed guard present in Claim and CancelOrder. When a seller accepts a resting-bid auction early via Claim, the order is marked IsClaimed but EndTime is not reset and the order is not deleted, creating a "zombie" order that appears live but is already settled. An attacker can exploit this by creating a resting auction, accepting it early (keeping the NFT), then waiting for victims to bid on the zombie order. The Buy function has no IsClaimed check, so it accepts the victim's bid, debits the victim's balance, refunds the prior (attacker-controlled) bidder, and records the victim as CurrentBidder. The victim then cannot Claim (blocked by IsClaimed) or CancelOrder (blocked by IsClaimed), permanently losing their funds. The attack is permissionless and repeatable, enabling theft via fund destruction and Sybil bidding.

## Affected products

- Klever Klever-Go prior to fix

## Identifiers

- CVE-2026-82406
- GHSA-26r5-4mm2-px5c
- GO-2026-6584

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: advisory: GHSA-26r5-4mm2-px5c

## Related threats

- [Klever-Go unauthenticated WebSocket /subscribe remote DoS](https://junglewise.ai/threats/cve-2026-86065-klever-go-unauthenticated-websocket-subscribe-remote-dos)
- [Klever-Go /log endpoint unauthenticated logging configuration manipulation](https://junglewise.ai/threats/cve-2026-86064-klever-go-log-endpoint-unauthenticated-logging-configuration)
- [Klever-Go Elasticsearch injection via account name](https://junglewise.ai/threats/cve-2026-82409-klever-go-elasticsearch-injection-via-account-name)
- [Klever-Go BLS public key validation bypass in validator registration](https://junglewise.ai/threats/cve-2026-82407-klever-go-bls-public-key-validation-bypass-in-validator)
- [Klever-Go account takeover via authorization bypass in UpdateAccountPermission](https://junglewise.ai/threats/cve-2026-82405-klever-go-account-takeover-via-authorization-bypass-in)