Is CVE-2026-82409 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82409 being exploited in the wild.

How severe is CVE-2026-82409?

High severity, with a CVSS score of 4, published 23 September 2026.

Which products and versions are affected?

github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.

Is there a fix for CVE-2026-82409?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82409 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82409?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82409: Klever-Go Elasticsearch injection via account name

Q: Is there a fix for CVE-2026-82409?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-82409 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-82409?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82409 · Severity: high · CVSS 4 · Published 2026-09-23

Klever-Go nodes index blockchain account data to Elasticsearch for use by public explorers and APIs. An attacker can submit a single ordinary transaction to name their own account with a specially crafted string, injecting malicious commands into the indexer's Elasticsearch bulk operations. This allows the attacker to forge transaction records, rewrite balances, delete governance proposals, or cause indexing to fail silently — affecting any explorer, API, or wallet relying on that data for real-world transactions and deposits.

Technologies: github.com/klever-io/klever-go (Go). Vendors: Go.

Quick answers

Is CVE-2026-82409 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82409 being exploited in the wild.
How severe is CVE-2026-82409?: High severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?: github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.
Is there a fix for CVE-2026-82409?: Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82409 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82409?: Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later
```
go get github.com/klever-io/klever-go@v1.7.20
```

Technical details

The vulnerability is a second-order injection in the Elasticsearch bulk indexer. When account names are serialized into bulk-API JSON painless script payloads at `indexer/common.go:2395–2407`, the name field is spliced directly using `fmt.Sprintf` without escaping. The on-chain `SetAccountName` transaction handler validates only UTF-8 and length (≤100 bytes), permitting quotes, backslashes, and newlines. Because the bulk body is NDJSON (newline-delimited), an attacker-controlled name can break the document structure, inject new bulk operations targeting arbitrary indices, and forge or delete documents. The attack is delivered as a single signed transaction broadcast to the network; it replicates through consensus state to all nodes, affecting current and future indexers. An existing safe escaper (`converters.JsonEscape`) is used for other fields but not for the name. Patches should either apply escaping to the name or rebuild the bulk payload using `json.Marshal` to eliminate string-splicing entirely.

Affected products

Klever Klever-Go prior to patch

Identifiers

CVE-2026-82409
GHSA-7c7c-373r-gfjj
GO-2026-6585

Timeline

2026-09-23: disclosed: GHSA-7c7c-373r-gfjj published
2026: other: CVE-2026-82409 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.