# CVE-2026-82407: Klever-Go BLS public key validation bypass in validator registration Source: https://junglewise.ai/threats/cve-2026-82407-klever-go-bls-public-key-validation-bypass-in-validator Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-09-23. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-82407 · Severity: high · CVSS 4 · Published 2026-09-23 Klever-Go's consensus layer uses BLS multi-signatures to finalize blocks, but the validator registration process does not validate submitted BLS public keys for mathematical correctness. An attacker can register a validator with a malformed public key for the cost of the minimum stake, causing the network to fail block production whenever that validator is selected for a consensus group. In networks with small validator sets, this can halt the entire chain; in larger networks, it causes ongoing slot misses and throughput degradation. Technologies: [github.com/klever-io/klever-go (Go)](https://junglewise.ai/threats/technologies/github-com-klever-io-klever-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go). ## Quick answers **Is CVE-2026-82407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82407 being exploited in the wild. **How severe is CVE-2026-82407?** High severity, with a CVSS score of 4, published 23 September 2026. **Which products and versions are affected?** github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20. **Is there a fix for CVE-2026-82407?** Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-82407 attacked?** It is attacked over the network, in a hosted service. **Am I affected by CVE-2026-82407?** Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later ```sh go get github.com/klever-io/klever-go@v1.7.20 ``` ## Technical details The vulnerability stems from missing cryptographic validation in the BLS validator registration flow. The `validators.Register` function accepts a 96-byte BLS public key without verifying that it is a valid point on the BLS12-381 curve, a member of the prime-order subgroup, or non-zero. The `CheckPublicKeyValid` function performs these checks at genesis time but is never called during runtime validator registration or updates. When an attacker's malformed key is deserialized during consensus group slot initialization, the `MultiSigner().Reset()` call deterministically fails in the underlying herumi BLS library, triggering `SetSlotCanceled(true)` and causing the entire block production round to be missed. The attack requires no proof-of-possession, no fork-dependent validation, and can be repeated by any party with enough stake to register a validator. ## Affected products - Klever Klever-Go