Executive brief
Klever-Go is a blockchain validator node implementation. An unauthenticated attacker can connect to the public /log WebSocket endpoint and send a specially crafted message to globally reconfigure the node's logging settings, suppressing important operational logs or forcing excessive verbosity. This allows an attacker to hide evidence of malicious activity or degrade system visibility during an attack.
Technical details
The /log WebSocket endpoint is enabled by default and does not require authentication. After the WebSocket upgrade, the server parses the first client message as a logger Profile and applies it process-wide via profile.Apply(), which mutates global log level patterns and formatting options. The vulnerability exists in network/api/api.go (unauthenticated upgrade) and network/api/logs/logSender.go (profile parsing). An unauthenticated network-connected attacker can send a malicious JSON profile payload to set LogLevelPatterns to "*:NONE" or other values, completely suppressing logs or enabling trace-level verbosity. The applied profile remains active for the lifetime of the attacker's WebSocket connection, then reverts on disconnect. No authentication or special privileges are required; the attack is trivial to execute and confirmed working in local reproduction.
Affected products
- Klever Klever-Go at least up to commit 9640d63265e910e166dfa694c8e5ddeb53018ffd
Timeline
- 2026-09-23: disclosed: GHSA-9v8p-frvj-2pcm published
- 2026-05-30: other: Vulnerability reproduced and confirmed on local validator