CVE-2026-46403

{
  "id": "CVE-2026-46403",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T20:17:01.067",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state."
    },
    {
      "lang": "es",
      "value": "Klever-Go es la implementación en Go del protocolo de blockchain de Klever. Antes de la versión 1.7.17, KVM expone ’ExecuteReadOnlyWithTypedArguments’ como un mecanismo de ejecución de solo lectura. El gancho guarda el estado de solo lectura anterior, establece ’runtime.SetReadOnly(true)’, ejecuta el contexto de destino y luego restaura el estado de solo lectura anterior. Sin embargo, las rutas indirectas de eliminación y actualización de contratos no rechazan la ejecución cuando ’runtime.ReadOnly()’ es verdadero. Como resultado, un contrato alcanzado a través de la ejecución de solo lectura puede llamar al gancho de eliminación de producción para un contrato de destino que posee. La ruta de eliminación añade la dirección de destino a ’vmOutput.DeletedAccounts’, el contexto de salida fusiona ’DeletedAccounts’ en la salida del llamador, y el procesador de contratos inteligentes procesa posteriormente la salida de la VM eliminando las cuentas listadas en ese campo. La causa raíz es que el modo de solo lectura se aplica como estado de tiempo de ejecución, pero no es forzado por las rutas host-core de eliminación y actualización que cambian el estado. Esto rompe el límite de aislamiento esperado para los flujos de trabajo que dependen de llamadas de solo lectura para inspeccionar otro contrato sin permitir que ese llamado produzca una salida de VM que cambie el estado. El problema está solucionado en la versión 1.7.17. Las rutas host-core de eliminación y actualización de contratos ahora rechazan la ejecución cuando ’runtime.ReadOnly()’ es verdadero. El invariante se prueba con pruebas de regresión para eliminación, actualización, escrituras de almacenamiento, transferencias de valor y cualquier campo de salida de la VM que pueda mutar posteriormente el estado de la cadena."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "klever-io",
          "product": "klever-go",
          "versions": [
            {
              "version": "< 1.7.17",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:26:16.323007Z",
          "id": "CVE-2026-46403",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/klever-io/klever-go/commit/333f6ec910906e227705fc5767dc897d8fbfc862",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/klever-io/klever-go/commit/68b94a40824fac2d848a4ded6eb7c91ada6ce9ef",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}