← Vulnerability feed

Vulnerability record · CVE-2026-82406 · published 23 September 2026

CVE-2026-82406: Klever-Go is the Go implementation of the Klever blockchain protocol.

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.

7.1 CVSS 4.0 High EPSS 0.34% · top 74.9% CWE-841 · CWE-841 Deferred
7.1CVSS 4.0 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
5References
24 Sep 2026Last modified by NVD

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2
https://github.com/klever-io/klever-go/pull/16
https://github.com/klever-io/klever-go/releases/tag/v1.7.20
https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c
https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c

Track CVE-2026-82406 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.9CVE-2026-67279Mikrotik routeros vulnerabilityRouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthent…KEVEPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2026-82406), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.