CVE-2026-46403 klever-io CVE debrief

Who should care

Users of Klever-Go, particularly those relying on read-only calls to inspect contracts, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying the patch to update to version 1.7.17 or later, conducting a thorough review of contracts to identify potential vulnerabilities, and implementing compensating controls to monitor and restrict contract deletion and upgrades.

Technical summary

Klever-Go's KVM implementation exposed a read-only execution mechanism that could be exploited to delete contracts. The issue was caused by the indirect contract delete and upgrade paths not rejecting execution when in read-only mode. The root cause lies in the application of read-only mode as runtime state without enforcement by state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows relying on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The fix was introduced in version 1.7.17, where contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to update to version 1.7.17 or later
• Conduct a thorough review of contracts to identify potential vulnerabilities
• Implement compensating controls to monitor and restrict contract deletion and upgrades
• Verify the integrity of affected systems and monitor for suspicious activity
• Review system logs for signs of exploitation
• Inventory affected assets and prioritize patching based on risk
• Establish a rollback plan in case of issues with patch deployment

Evidence notes

The CVE record was published on 2026-07-21T20:17:01.067Z and last modified on 2026-07-22T15:17:16.057Z. The NVD entry is currently MEDIUM. The vulnerability affects Klever-Go's KVM implementation, which exposed a read-only execution mechanism that could be exploited to delete contracts. The issue was caused by the indirect contract delete and upgrade paths not rejecting execution when in read-only mode. The fix was introduced in version 1.7.17. To verify, defenders should review the official advisory and assess their exposure.

Official resources