CVE-2026-86064: Klever-Go: /log controls global node logging

An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node’s global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an unauthenticated client set the global log level to *:NONE, the node accepted the profile, and the node stopped emitting normal slot logs while the WebSocket connection remained open.

This is not a duplicate of the published KVM or P2P advisories. It is a management-plane flaw in the public WebSocket logging endpoint.