CVE-2026-46403 is a vulnerability in klever-io's klever-go blockchain protocol implementation prior to version 1.7.17. The vulnerability arises because the read-only execution mode, exposed via ExecuteReadOnlyWithTypedArguments, sets a runtime read-only flag but does not enforce this state in indirect contract delete and upgrade paths. Consequently, a contract called in read-only mode can invoke the production delete hook to delete contracts it owns. The delete operation appends the target contract address to a deletion list processed later to remove accounts, thus enabling unauthorized state changes during what should be read-only calls. The root cause is that read-only mode is a runtime state flag but not enforced by state-changing host-core paths. This breaks the isolation expected from read-only calls. The issue was fixed in version 1.7.17 by adding checks that reject delete and upgrade executions when runtime.ReadOnly() is true, with regression tests covering delete, upgrade, storage writes, value transfers, and other VM output fields that mutate chain state.

The vulnerability allows contracts invoked in read-only mode to perform unauthorized state changes, specifically deleting contracts they own. This breaks the isolation boundary of read-only calls, potentially leading to unintended or malicious contract deletions. The impact is limited to integrity (I:H) with no confidentiality or availability impact reported. The CVSS 3.1 score is 6.3 (medium) reflecting a network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change.

A fix is available in klever-go version 1.7.17. Users should upgrade to version 1.7.17 or later to ensure that contract delete and upgrade operations are rejected during read-only execution, restoring the expected isolation boundary. Patch status is confirmed by the vendor's advisory stating the issue is fixed in v1.7.17. No additional mitigation actions are indicated.