# CVE-2026-82409: Klever-Go Elasticsearch injection via account name

Source: https://junglewise.ai/threats/cve-2026-82409-klever-go-elasticsearch-injection-via-account-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82409 · Severity: high · CVSS 4 · Published 2026-09-23

Klever-Go nodes index blockchain account data to Elasticsearch for use by public explorers and APIs. An attacker can submit a single ordinary transaction to name their own account with a specially crafted string, injecting malicious commands into the indexer's Elasticsearch bulk operations. This allows the attacker to forge transaction records, rewrite balances, delete governance proposals, or cause indexing to fail silently — affecting any explorer, API, or wallet relying on that data for real-world transactions and deposits.

Technologies: [github.com/klever-io/klever-go (Go)](https://junglewise.ai/threats/technologies/github-com-klever-io-klever-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-82409 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82409 being exploited in the wild.

**How severe is CVE-2026-82409?** High severity, with a CVSS score of 4, published 23 September 2026.

**Which products and versions are affected?** github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.

**Is there a fix for CVE-2026-82409?** Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82409 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82409?** Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later

  ```sh
  go get github.com/klever-io/klever-go@v1.7.20
  ```


## Technical details

The vulnerability is a second-order injection in the Elasticsearch bulk indexer. When account names are serialized into bulk-API JSON painless script payloads at `indexer/common.go:2395–2407`, the name field is spliced directly using `fmt.Sprintf` without escaping. The on-chain `SetAccountName` transaction handler validates only UTF-8 and length (≤100 bytes), permitting quotes, backslashes, and newlines. Because the bulk body is NDJSON (newline-delimited), an attacker-controlled name can break the document structure, inject new bulk operations targeting arbitrary indices, and forge or delete documents. The attack is delivered as a single signed transaction broadcast to the network; it replicates through consensus state to all nodes, affecting current and future indexers. An existing safe escaper (`converters.JsonEscape`) is used for other fields but not for the name. Patches should either apply escaping to the name or rebuild the bulk payload using `json.Marshal` to eliminate string-splicing entirely.

## Affected products

- Klever Klever-Go prior to patch

## Identifiers

- CVE-2026-82409
- GHSA-7c7c-373r-gfjj
- GO-2026-6585

## Timeline

- 2026-09-23: disclosed: GHSA-7c7c-373r-gfjj published
- 2026: other: CVE-2026-82409 assigned

## Related threats

- [Klever-Go unauthenticated WebSocket /subscribe remote DoS](https://junglewise.ai/threats/cve-2026-86065-klever-go-unauthenticated-websocket-subscribe-remote-dos)
- [Klever-Go /log endpoint unauthenticated logging configuration manipulation](https://junglewise.ai/threats/cve-2026-86064-klever-go-log-endpoint-unauthenticated-logging-configuration)
- [Klever-Go BLS public key validation bypass in validator registration](https://junglewise.ai/threats/cve-2026-82407-klever-go-bls-public-key-validation-bypass-in-validator)
- [Klever-Go marketplace Buy missing IsClaimed guard](https://junglewise.ai/threats/cve-2026-82406-klever-go-marketplace-buy-missing-isclaimed-guard)
- [Klever-Go account takeover via authorization bypass in UpdateAccountPermission](https://junglewise.ai/threats/cve-2026-82405-klever-go-account-takeover-via-authorization-bypass-in)