https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 24 Sep 2026 04:43:01 +0000 https://vulnerability.circl.lu/sighting/d6cc9c4a-4ff2-4ab4-bd42-01b138d735e0/export {"uuid": "d6cc9c4a-4ff2-4ab4-bd42-01b138d735e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82405", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm", "content": "", "creation_timestamp": "2026-09-23T20:35:02.647584Z"} {"uuid": "d6cc9c4a-4ff2-4ab4-bd42-01b138d735e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82405", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm", "content": "", "creation_timestamp": "2026-09-23T20:35:02.647584Z"} https://vulnerability.circl.lu/sighting/d6cc9c4a-4ff2-4ab4-bd42-01b138d735e0/export Wed, 23 Sep 2026 20:35:02 +0000 https://vulnerability.circl.lu/sighting/2bf97ac9-109e-4557-8fee-a669281ba893/export {"uuid": "2bf97ac9-109e-4557-8fee-a669281ba893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82405", "type": "seen", "source": "https://gist.github.com/alon710/5f3098f0ef594e678313ac3cea1fd61f", "content": "# CVE-2026-82405: CVE-2026-82405: Incorrect Authorization leading to Account Takeover in klever-go\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-82405\n\n## Summary\nA critical incorrect authorization vulnerability (CWE-863) exists in the Go implementation of the Klever blockchain protocol (klever-go) prior to version 1.7.20. The vulnerability allows an attacker to completely replace a target account's permission set by manipulating the RecipientAddr parameter in a VM built-in function, leading to total account takeover.\n\n## TL;DR\nAn incorrect authorization flaw in klever-go < 1.7.20 allows attackers to overwrite any account's permission set using a malicious contract call, resulting in unauthorized account takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v1.7.20\n\n## Affected Systems\n\n- klever-go\n- **klever-go**: < 1.7.20 (Fixed in: `1.7.20`)\n\n## Mitigation\n\n- Upgrade all running node implementations of klever-go to version 1.7.20 or later.\n- Verify that all custom blockchain integrations pass cryptographically validated caller addresses to permission endpoints.\n- Monitor on-chain events for unexpected UpdatePermission contract executions.\n\n**Remediation Steps:**\n1. Download the patched release of klever-go (version 1.7.20) from the official GitHub repository.\n2. Compile the node binary using Go and deploy it to validator and public node hosts.\n3. Verify the version output of the running daemon to confirm the patch is active.\n4. Conduct a state-level audit of registered permissions to identify any unauthorized self-signing modification events.\n\n## References\n\n- [GHSA-97cv-x867-6xhm Security Advisory](https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm)\n- [Fix Commit on GitHub](https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32)\n- [Technical Proof of Concept](https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9)\n- [Klever Go v1.7.20 Release Tag](https://github.com/klever-io/klever-go/releases/tag/v1.7.20)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-82405) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T20:32:15.205352Z"} {"uuid": "2bf97ac9-109e-4557-8fee-a669281ba893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82405", "type": "seen", "source": "https://gist.github.com/alon710/5f3098f0ef594e678313ac3cea1fd61f", "content": "# CVE-2026-82405: CVE-2026-82405: Incorrect Authorization leading to Account Takeover in klever-go\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-82405\n\n## Summary\nA critical incorrect authorization vulnerability (CWE-863) exists in the Go implementation of the Klever blockchain protocol (klever-go) prior to version 1.7.20. The vulnerability allows an attacker to completely replace a target account's permission set by manipulating the RecipientAddr parameter in a VM built-in function, leading to total account takeover.\n\n## TL;DR\nAn incorrect authorization flaw in klever-go < 1.7.20 allows attackers to overwrite any account's permission set using a malicious contract call, resulting in unauthorized account takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v1.7.20\n\n## Affected Systems\n\n- klever-go\n- **klever-go**: < 1.7.20 (Fixed in: `1.7.20`)\n\n## Mitigation\n\n- Upgrade all running node implementations of klever-go to version 1.7.20 or later.\n- Verify that all custom blockchain integrations pass cryptographically validated caller addresses to permission endpoints.\n- Monitor on-chain events for unexpected UpdatePermission contract executions.\n\n**Remediation Steps:**\n1. Download the patched release of klever-go (version 1.7.20) from the official GitHub repository.\n2. Compile the node binary using Go and deploy it to validator and public node hosts.\n3. Verify the version output of the running daemon to confirm the patch is active.\n4. Conduct a state-level audit of registered permissions to identify any unauthorized self-signing modification events.\n\n## References\n\n- [GHSA-97cv-x867-6xhm Security Advisory](https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm)\n- [Fix Commit on GitHub](https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32)\n- [Technical Proof of Concept](https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9)\n- [Klever Go v1.7.20 Release Tag](https://github.com/klever-io/klever-go/releases/tag/v1.7.20)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-82405) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T20:32:15.205352Z"} https://vulnerability.circl.lu/sighting/2bf97ac9-109e-4557-8fee-a669281ba893/export Wed, 23 Sep 2026 20:32:15 +0000