Klever-Go exposes a WebSocket endpoint at /log that is reachable via GET requests. That endpoint parses the first client message as a logger profile and applies it process‑wide, allowing a remote entity to alter log levels, formatting, and to receive live logs. Because no authentication is required in versions prior to 1.7.20, an attacker can suppress critical logs, increase verbosity, or leak operational details without credentials. The payload is a configuration profile, not executable code, so the vulnerability does not lead to arbitrary code execution but provides significant visibility and control over the node’s logging behavior.

The vulnerability affects the Klever blockchain Go implementation (klever-io:klever-go) in all versions released before 1.7.20. The change was introduced in the v1.7.20 release, which adds an authentication requirement, thereby closing the previously open /log WebSocket endpoint.

The CVSS score of 8.6 highlights high severity. Because the /log route is open on earlier versions, an attacker can exploit the vulnerability if the node is publicly reachable. The EPSS score is not available. The vulnerability is not listed in CISA KEV, but the lack of authentication and the ability to tamper with global logging provide a moderate to high risk, especially in production deployments where operational visibility is critical. Once a node is updated to 1.7.20 or newer, authentication protects the endpoint and mitigates the exploitation vector.