An unauthenticated vulnerability in the Klever-Go blockchain protocol allows remote attackers to exfiltrate operational logs and manipulate system logging settings.

The vulnerability stems from a lack of authentication on the GET /log WebSocket endpoint, which permits unauthenticated remote users to inject logger profiles and subscribe to live process streams. By exploiting this, an attacker can suppress critical error logs, increase verbosity to hide malicious activity, or exfiltrate sensitive operational information.

The ability to access live process logs and manipulate system visibility poses a significant risk to the integrity and confidentiality of blockchain node operations. With a CVSS score of 8.6, this vulnerability is classified as High severity, as it facilitates unauthorized information disclosure and potential interference with incident response visibility. Compromise could lead to undetected malicious activity within the network or the exposure of sensitive internal node configurations.

Immediate Action: Update the Klever-Go installation to version 1.7.20 or later, which enforces proper authentication on the affected WebSocket route.

Proactive Monitoring: Review WebSocket traffic logs for unauthorized connections to the /log endpoint and monitor for unexpected changes to global log levels or formatting configurations.

Compensating Controls: Deploy a Web Application Firewall or network access control list to restrict access to the Klever-Go API endpoints, ensuring only authorized management IP addresses can establish WebSocket connections.

Public Exploit Available: Unknown.

Given the high CVSS score and the sensitive nature of blockchain node operations, this vulnerability should be prioritized for immediate remediation. Organizations running Klever-Go must apply the 1.7.20 patch to close the unauthenticated access vector and prevent potential log manipulation or data exfiltration by unauthorized parties.