CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use AssetTrigger UpdateRoyalties to make the combined referral and royalty percentages exceed the bid. executeBuyMarket pays referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder, allowing MarketBuy, BuyItNow, or auction Claim settlement to credit more KLV or sale currency than the buyer paid. This can create unbacked currency and corrupt token supply integrity. This issue is fixed in version 1.7.19.

• CWE-191
• CWE-367
• CWE-682

• https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251
• https://github.com/klever-io/klever-go/releases/tag/v1.7.19
• https://github.com/klever-io/klever-go/security/advisories/GHSA-p7gw-2pcp-5pf8
• https://github.com/klever-io/klever-go/security/advisories/GHSA-p7gw-2pcp-5pf8

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54743Lemmy is a link aggregator and forum for the fediverse. Prio…6.4
• CVE-2026-54745Kubeflow Pipelines enables users to build and deploy portabl…10
• CVE-2026-54746Hatchet is a platform for orchestrating background tasks, AI…6.4
• CVE-2026-5475A vulnerability was determined in NASA cFS up to 7.0.0. This…5.5
• CVE-2026-54752NetBox Device Type Library is a collection of community-sour…9.6
• CVE-2026-54753Nx is a monorepo solution for TypeScript and polyglot codeba…5.9
• CVE-2026-54755Klever-Go is the Go implementation of the Klever blockchain …9.6
• CVE-2026-54756Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-54757Compliance-trestle (Trestle) is a Python SDK and command-lin…7.8
• CVE-2026-54758Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-54759SiYuan is an open-source personal knowledge management syste…8.7
• CVE-2026-5476A vulnerability was identified in NASA cFS up to 7.0.0 on 32…4.6