Klever-Go, the Go implementation of the Klever blockchain protocol, has an unauthenticated WebSocket endpoint (/log) that allows remote clients to send a logger Profile message. This message is applied process-wide, enabling the client to modify global log levels and formatting until the connection closes. Additionally, the client connection is registered as a log observer, allowing it to receive live logs from the process. This exposure can suppress normal logs, increase verbosity, distort operator visibility, and leak operational information without requiring credentials. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information) and CWE-306 (Missing Authentication for Critical Function). It is fixed in Klever-Go version 1.7.20.

An unauthenticated remote attacker can manipulate logging behavior and access live operational logs, potentially suppressing or distorting logs and gaining sensitive information about the system's operation. This can hinder detection and response efforts and expose sensitive internal details. The CVSS v3.1 score is 8.6 (High), reflecting network attack vector, no privileges required, no user interaction, high confidentiality impact, low integrity impact, and low availability impact.

Upgrade Klever-Go to version 1.7.20 or later, where this vulnerability is fixed. Prior to upgrading, restrict access to the /log WebSocket endpoint to trusted clients only, if possible. No other vendor advisory mitigation details are provided.