CVE-2026-46403
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state.
INFO
Published Date :
July 21, 2026, 8:17 p.m.
Last Modified :
Oct. 24, 2026, 7:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update Klever-Go to version 1.7.17.
- Verify read-only mode enforcement is active.
- Test delete and upgrade paths.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46403.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46403 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46403
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46403 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46403 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: klever-go de klever-io, Description: Klever-Go es la implementación en Go del protocolo de blockchain de Klever. Antes de la versión 1.7.17, KVM expone ’ExecuteReadOnlyWithTypedArguments’ como un mecanismo de ejecución de solo lectura. El gancho guarda el estado de solo lectura anterior, establece ’runtime.SetReadOnly(true)’, ejecuta el contexto de destino y luego restaura el estado de solo lectura anterior. Sin embargo, las rutas indirectas de eliminación y actualización de contratos no rechazan la ejecución cuando ’runtime.ReadOnly()’ es verdadero. Como resultado, un contrato alcanzado a través de la ejecución de solo lectura puede llamar al gancho de eliminación de producción para un contrato de destino que posee. La ruta de eliminación añade la dirección de destino a ’vmOutput.DeletedAccounts’, el contexto de salida fusiona ’DeletedAccounts’ en la salida del llamador, y el procesador de contratos inteligentes procesa posteriormente la salida de la VM eliminando las cuentas listadas en ese campo. La causa raíz es que el modo de solo lectura se aplica como estado de tiempo de ejecución, pero no es forzado por las rutas host-core de eliminación y actualización que cambian el estado. Esto rompe el límite de aislamiento esperado para los flujos de trabajo que dependen de llamadas de solo lectura para inspeccionar otro contrato sin permitir que ese llamado produzca una salida de VM que cambie el estado. El problema está solucionado en la versión 1.7.17. Las rutas host-core de eliminación y actualización de contratos ahora rechazan la ejecución cuando ’runtime.ReadOnly()’ es verdadero. El invariante se prueba con pruebas de regresión para eliminación, actualización, escrituras de almacenamiento, transferencias de valor y cualquier campo de salida de la VM que pueda mutar posteriormente el estado de la cadena. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 22, 2026
Action Type Old Value New Value Added Reference https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33 Added SSVC {'id': 'CVE-2026-46403', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-22T14:26:16.323007Z'} -
New CVE Received by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'klever-io', 'product': 'klever-go', 'versions': [{'status': 'affected', 'version': '< 1.7.17'}]}] Added Description Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state. Added CVSS V3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N Added CWE CWE-693 Added Reference https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862 Added Reference https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef Added Reference https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33