Is CVE-2026-86064 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86064 being exploited in the wild.

How severe is CVE-2026-86064?

High severity, with a CVSS score of 8.6, published 23 September 2026.

Which products and versions are affected?

github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.

Is there a fix for CVE-2026-86064?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86064 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-86064?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86064: Klever-Go /log endpoint unauthenticated logging configuration manipulation

Q: Is there a fix for CVE-2026-86064?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-86064 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-86064?

Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86064 · Severity: high · CVSS 8.6 · Published 2026-09-23

Klever-Go is a blockchain validator node implementation. An unauthenticated attacker can connect to the public /log WebSocket endpoint and send a specially crafted message to globally reconfigure the node's logging settings, suppressing important operational logs or forcing excessive verbosity. This allows an attacker to hide evidence of malicious activity or degrade system visibility during an attack.

Technologies: github.com/klever-io/klever-go (Go). Vendors: Go.

Quick answers

Is CVE-2026-86064 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86064 being exploited in the wild.
How severe is CVE-2026-86064?: High severity, with a CVSS score of 8.6, published 23 September 2026.
Which products and versions are affected?: github.com/klever-io/klever-go (Go) <= 1.7.19, SEMVER:introduced=0,fixed=1.7.20.
Is there a fix for CVE-2026-86064?: Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86064 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-86064?: Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/klever-io/klever-go (Go): upgrade to 1.7.20 or later
```
go get github.com/klever-io/klever-go@v1.7.20
```

Technical details

The /log WebSocket endpoint is enabled by default and does not require authentication. After the WebSocket upgrade, the server parses the first client message as a logger Profile and applies it process-wide via profile.Apply(), which mutates global log level patterns and formatting options. The vulnerability exists in network/api/api.go (unauthenticated upgrade) and network/api/logs/logSender.go (profile parsing). An unauthenticated network-connected attacker can send a malicious JSON profile payload to set LogLevelPatterns to "*:NONE" or other values, completely suppressing logs or enabling trace-level verbosity. The applied profile remains active for the lifetime of the attacker's WebSocket connection, then reverts on disconnect. No authentication or special privileges are required; the attack is trivial to execute and confirmed working in local reproduction.

Affected products

Klever Klever-Go at least up to commit 9640d63265e910e166dfa694c8e5ddeb53018ffd

Identifiers

CVE-2026-86064
GHSA-9v8p-frvj-2pcm
GO-2026-6583

Timeline

2026-09-23: disclosed: GHSA-9v8p-frvj-2pcm published
2026-05-30: other: Vulnerability reproduced and confirmed on local validator

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.