Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| klever-io | klever-go | before 1.7.20 | 1.7.20 | Patch available | CNA |
| — | github.com/klever-io/klever-go (Go) | before 1.7.20 | 1.7.20 | Patch available | GHSA-26r5-4mm2-px5c |
- klever-go Vendorklever-io Affected before 1.7.20 Fixed in 1.7.20 Patch available CNA
- github.com/klever-io/klever-go (Go) Vendor— Affected before 1.7.20 Fixed in 1.7.20 Patch available GHSA-26r5-4mm2-px5c
Remediation
- Fix · CNA klever-go (klever-io) Fixed in 1.7.20
- Fix · GHSA-26r5-4mm2-px5c github.com/klever-io/klever-go (Go) Fixed in 1.7.20 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82406
- 2026-10-03 Alias added: GHSA-26r5-4mm2-px5c
References
Other 5
- https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c
- https://github.com/klever-io/klever-go/pull/16
- https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2
- https://github.com/klever-io/klever-go/releases/tag/v1.7.20
- https://github.com/klever-io/klever-go
More klever-io vulnerabilities
- TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
- TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
- TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
- TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
- TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
- TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
Sources
- CVE-2026-82406 · CVE Program
- CVE-2026-82406 · NVD
- FIRST EPSS
- GHSA-26r5-4mm2-px5c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences