CVE-2026-46403

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46403", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T21:04:10.932Z", "datePublished": "2026-07-21T19:51:18.745Z", "dateUpdated": "2026-07-22T14:28:22.326Z"}, "containers": {"cna": {"title": "Klever-Go KVM read-only execution can commit contract delete and upgrade side effects", "problemTypes": [{"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33"}, {"name": "https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862", "tags": ["x_refsource_MISC"], "url": "https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862"}, {"name": "https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef", "tags": ["x_refsource_MISC"], "url": "https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef"}], "affected": [{"vendor": "klever-io", "product": "klever-go", "versions": [{"version": "< 1.7.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-21T19:51:18.745Z"}, "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state."}], "source": {"advisory": "GHSA-jc6w-wmfc-fh33", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T14:26:16.323007Z", "id": "CVE-2026-46403", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:28:22.326Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46403", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:26:16.323007Z"}}}], "references": [{"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T14:27:46.153Z"}}], "cna": {"title": "Klever-Go KVM read-only execution can commit contract delete and upgrade side effects", "source": {"advisory": "GHSA-jc6w-wmfc-fh33", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "klever-io", "product": "klever-go", "versions": [{"status": "affected", "version": "< 1.7.17"}]}], "references": [{"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33", "name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862", "name": "https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef", "name": "https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-21T19:51:18.745Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46403", "state": "PUBLISHED", "dateUpdated": "2026-07-22T14:28:22.326Z", "dateReserved": "2026-05-13T21:04:10.932Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-21T19:51:18.745Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "klever-go", "vendor": "klever-io", "versions": [{"status": "affected", "version": "< 1.7.17"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state."}, {"lang": "es", "value": "Klever-Go es la implementaci\u00f3n en Go del protocolo de blockchain de Klever. Antes de la versi\u00f3n 1.7.17, KVM expone \u2019ExecuteReadOnlyWithTypedArguments\u2019 como un mecanismo de ejecuci\u00f3n de solo lectura. El gancho guarda el estado de solo lectura anterior, establece \u2019runtime.SetReadOnly(true)\u2019, ejecuta el contexto de destino y luego restaura el estado de solo lectura anterior. Sin embargo, las rutas indirectas de eliminaci\u00f3n y actualizaci\u00f3n de contratos no rechazan la ejecuci\u00f3n cuando \u2019runtime.ReadOnly()\u2019 es verdadero. Como resultado, un contrato alcanzado a trav\u00e9s de la ejecuci\u00f3n de solo lectura puede llamar al gancho de eliminaci\u00f3n de producci\u00f3n para un contrato de destino que posee. La ruta de eliminaci\u00f3n a\u00f1ade la direcci\u00f3n de destino a \u2019vmOutput.DeletedAccounts\u2019, el contexto de salida fusiona \u2019DeletedAccounts\u2019 en la salida del llamador, y el procesador de contratos inteligentes procesa posteriormente la salida de la VM eliminando las cuentas listadas en ese campo. La causa ra\u00edz es que el modo de solo lectura se aplica como estado de tiempo de ejecuci\u00f3n, pero no es forzado por las rutas host-core de eliminaci\u00f3n y actualizaci\u00f3n que cambian el estado. Esto rompe el l\u00edmite de aislamiento esperado para los flujos de trabajo que dependen de llamadas de solo lectura para inspeccionar otro contrato sin permitir que ese llamado produzca una salida de VM que cambie el estado. El problema est\u00e1 solucionado en la versi\u00f3n 1.7.17. Las rutas host-core de eliminaci\u00f3n y actualizaci\u00f3n de contratos ahora rechazan la ejecuci\u00f3n cuando \u2019runtime.ReadOnly()\u2019 es verdadero. El invariante se prueba con pruebas de regresi\u00f3n para eliminaci\u00f3n, actualizaci\u00f3n, escrituras de almacenamiento, transferencias de valor y cualquier campo de salida de la VM que pueda mutar posteriormente el estado de la cadena."}], "id": "CVE-2026-46403", "lastModified": "2026-10-24T19:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46403", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T14:26:16.323007Z", "version": "2.0.3"}}]}, "published": "2026-07-21T20:17:01.067", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862"}, {"source": "security-advisories@github.com", "url": "https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef"}, {"source": "security-advisories@github.com", "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.17)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "klever-go", "source": "cna", "vendor": "klever-io"}, "product": "klever-go", "vendor": "klever-io"}], "created": "2026-07-23T05:30:17.668285+00:00", "updated": "2026-07-30T16:45:04.019853+00:00", "vendors": ["klever-io", "klever-io$PRODUCT$klever-go"]}