CVE-2026-86064

An unauthenticated client can connect to `GET /log`, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to `*:NONE`, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open. This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint. ## Vulnerability details ### Affected code - Route exposed by default in `config/node/api.yaml` - Route registration in `network/api/api.go` - Unauthenticated upgrade in `network/api/api.go` - First client message is parsed as a logger profile and applied globally in `network/api/logs/logSender.go` - Global logger mutation happens in dependency `github.com/klever-io/klever-go-logger`, `profile.go`, `Apply()` ### Root cause `/log` is enabled by default and does not require authentication. After the WebSocket upgrade, the server reads the first client message and treats it as a logger `Profile`. That profile is then applied process-wide through `profile.Apply()`, which changes global log level patterns and output formatting options for the whole node. After that handshake, the same unauthenticated connection is registered as a log observer and receives live logs from the running process. ## Reproduction steps ### Environment - Validator built from the repository at commit `9640d63265e910e166dfa694c8e5ddeb53018ffd` - REST API bound locally for validation - Tested on 2026-05-30 ### Step 1: Build and run a local validator from source ```bash cd <repo-root> go build -o ./bin/validator ./cmd/node ./bin/validator \ --rest-api-interface=127.0.0.1:18080 \ --port=18083 \ --config=./config/node/config.yaml \ --config-api=./config/node/api.yaml \ --config-ep