CVE-2026-46403

Name of the Vulnerable Software and Affected Versions klever-go versions prior to 1.7.17

Description KVM read-only execution fails to properly isolate state-changing operations. The ExecuteReadOnlyWithTypedArguments function sets the runtime to read-only mode, but the host-core paths for contract deletion and upgrades do not enforce this restriction. Consequently, a contract invoked via a read-only call can trigger the deletion or upgrade of a target contract it owns. This occurs because the delete path appends the target address to the DeletedAccounts field in the VM output, which is later processed by the smart contract processor to delete the accounts. This allows an untrusted callee to produce state-changing side effects while appearing to operate in a non-mutating read-only context.

Recommendations Upgrade to version 1.7.17. As a temporary workaround, restrict the use of the ExecuteReadOnlyWithTypedArguments function when interacting with untrusted contracts until the update is applied.