CVE-2026-86064: Klever-Go: /log controls global node logging
An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node’s global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to *:NONE, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.
This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.
References
- github.com/advisories/GHSA-9v8p-frvj-2pcm
- github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2
- github.com/klever-io/klever-go/pull/74
- github.com/klever-io/klever-go/releases/tag/v1.7.20
- github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm
- nvd.nist.gov/vuln/detail/CVE-2026-86064
Code Behaviors & Features
Detect and mitigate CVE-2026-86064 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →