PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46403 klever-io CVE debrief

A vulnerability was discovered in Klever-Go's KVM implementation, exposing a read-only execution mechanism that could be exploited to delete contracts. The issue was caused by the indirect contract delete and upgrade paths not rejecting execution when in read-only mode. The fix was introduced in version 1.7.17. This vulnerability impacts users of Klever-Go, particularly those relying on read-only calls to inspect contracts. The vulnerability has a CVSS score of 6.3 and a severity of MEDIUM.

Vendor
klever-io
Product
klever-go
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Users of Klever-Go, particularly those relying on read-only calls to inspect contracts, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying the patch to update to version 1.7.17 or later, conducting a thorough review of contracts to identify potential vulnerabilities, and implementing compensating controls to monitor and restrict contract deletion and upgrades.

Technical summary

Klever-Go's KVM implementation exposed a read-only execution mechanism that could be exploited to delete contracts. The issue was caused by the indirect contract delete and upgrade paths not rejecting execution when in read-only mode. The root cause lies in the application of read-only mode as runtime state without enforcement by state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows relying on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The fix was introduced in version 1.7.17, where contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the patch to update to version 1.7.17 or later
  • Conduct a thorough review of contracts to identify potential vulnerabilities
  • Implement compensating controls to monitor and restrict contract deletion and upgrades
  • Verify the integrity of affected systems and monitor for suspicious activity
  • Review system logs for signs of exploitation
  • Inventory affected assets and prioritize patching based on risk
  • Establish a rollback plan in case of issues with patch deployment

Evidence notes

The CVE record was published on 2026-07-21T20:17:01.067Z and last modified on 2026-07-22T15:17:16.057Z. The NVD entry is currently MEDIUM. The vulnerability affects Klever-Go's KVM implementation, which exposed a read-only execution mechanism that could be exploited to delete contracts. The issue was caused by the indirect contract delete and upgrade paths not rejecting execution when in read-only mode. The fix was introduced in version 1.7.17. To verify, defenders should review the official advisory and assess their exposure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46403 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46403

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46403 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46403

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.