Executive brief
Klever-Go nodes index blockchain account data to Elasticsearch for use by public explorers and APIs. An attacker can submit a single ordinary transaction to name their own account with a specially crafted string, injecting malicious commands into the indexer's Elasticsearch bulk operations. This allows the attacker to forge transaction records, rewrite balances, delete governance proposals, or cause indexing to fail silently — affecting any explorer, API, or wallet relying on that data for real-world transactions and deposits.
Technical details
The vulnerability is a second-order injection in the Elasticsearch bulk indexer. When account names are serialized into bulk-API JSON painless script payloads at `indexer/common.go:2395–2407`, the name field is spliced directly using `fmt.Sprintf` without escaping. The on-chain `SetAccountName` transaction handler validates only UTF-8 and length (≤100 bytes), permitting quotes, backslashes, and newlines. Because the bulk body is NDJSON (newline-delimited), an attacker-controlled name can break the document structure, inject new bulk operations targeting arbitrary indices, and forge or delete documents. The attack is delivered as a single signed transaction broadcast to the network; it replicates through consensus state to all nodes, affecting current and future indexers. An existing safe escaper (`converters.JsonEscape`) is used for other fields but not for the name. Patches should either apply escaping to the name or rebuild the bulk payload using `json.Marshal` to eliminate string-splicing entirely.
Affected products
- Klever Klever-Go prior to patch
Timeline
- 2026-09-23: disclosed: GHSA-7c7c-373r-gfjj published
- 2026: other: CVE-2026-82409 assigned