CVE-2026-82042: UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UTMStackto a version that resolves this vulnerability.Fixed in 11.2.16
Event History
Frequently Asked Questions
Who is exposed to this issue?
UTMStack deployments running a version before 11.2.16 are exposed if an attacker can reach the affected API and obtains the value of the INTERNAL_KEY environment variable.
What does an attacker need to exploit it?
The attacker needs a valid Utm-Internal-Key header whose value matches INTERNAL_KEY. No user account or JWT is required once the key is known.
What access does successful exploitation provide?
A successful attacker gains full administrative API access. This can be used to create accounts, manage users, exfiltrate data, and modify security rules.
Are only internal API routes affected?
No. The InternalApiKeyFilter accepts the matching key for any endpoint because it has no path restriction.
What version addresses the issue?
The issue affects versions before 11.2.16; upgrading to 11.2.16 or later addresses the affected version range.