CVE-2026-82409

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20

Description An issue exists in the Elasticsearch indexer component where the serializedDataForUpdateAccounts function in indexer/common.go fails to escape the acc.Name variable when constructing bulk JSON and NDJSON requests. The SetAccountName transaction allows account names containing quotes, backslashes, and newlines, which are stored in the consensus account state. When an indexer processes these accounts, an attacker can inject arbitrary keys or new bulk operations into the request. This allows for the creation, overwriting, or deletion of documents across any index the indexer has permissions to write to, such as transactions, blocks, accounts, proposals, assets, and marketplaces. Additionally, specially crafted names can cause Elasticsearch to reject entire bulk batches, leading to a denial-of-indexing where the explorer or API serves stale data. Because the payload is stored in the replicated state, it affects all current and future indexers and persists through historical re-indexing.

Recommendations Update to version 1.7.20. As a temporary mitigation, restrict the allowed characters for account names in the SetAccountName function to reject control characters, quotes, and backslashes.