Is CVE-2026-82407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82407 being exploited in the wild.

How severe is CVE-2026-82407?

High severity, with a CVSS score of 4, published 23 September 2026.

Which products and versions are affected?

github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.

Is there a fix for CVE-2026-82407?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82407 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-82407?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82407: Klever-Go BLS public key validation bypass in validator registration

Q: Is there a fix for CVE-2026-82407?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-82407 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-82407?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82407 · Severity: high · CVSS 4 · Published 2026-09-23

Klever-Go's consensus layer uses BLS multi-signatures to finalize blocks, but the validator registration process does not validate submitted BLS public keys for mathematical correctness. An attacker can register a validator with a malformed public key for the cost of the minimum stake, causing the network to fail block production whenever that validator is selected for a consensus group. In networks with small validator sets, this can halt the entire chain; in larger networks, it causes ongoing slot misses and throughput degradation.

Technologies: github.com/klever-io/klever-go (Go). Vendors: Go.

Quick answers

Is CVE-2026-82407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82407 being exploited in the wild.
How severe is CVE-2026-82407?: High severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?: github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.
Is there a fix for CVE-2026-82407?: Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82407 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-82407?: Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later
```
go get github.com/klever-io/klever-go@v1.7.20
```

Technical details

The vulnerability stems from missing cryptographic validation in the BLS validator registration flow. The `validators.Register` function accepts a 96-byte BLS public key without verifying that it is a valid point on the BLS12-381 curve, a member of the prime-order subgroup, or non-zero. The `CheckPublicKeyValid` function performs these checks at genesis time but is never called during runtime validator registration or updates. When an attacker's malformed key is deserialized during consensus group slot initialization, the `MultiSigner().Reset()` call deterministically fails in the underlying herumi BLS library, triggering `SetSlotCanceled(true)` and causing the entire block production round to be missed. The attack requires no proof-of-possession, no fork-dependent validation, and can be repeated by any party with enough stake to register a validator.

Affected products

Klever Klever-Go <unknown

Identifiers

CVE-2026-82407
GHSA-9wh6-9hq7-9688
GO-2026-6586

Timeline

2026-09-23: disclosed: Advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.