CVE-2026-82641: keploy 3.1.0 through 3.6.25 Unauthenticated TLS Key Exposure
keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
keployto a version that resolves this vulnerability.Fixed in 3.1.0 - Upgrade
Upgrade
keployto a version that resolves this vulnerability.Fixed in 3.6.25
Event History
Frequently Asked Questions
Which deployments are exposed to remote access?
Keploy versions 3.1.0 through 3.6.25 are exposed when their agent control-plane HTTP server is reachable over the network. The server binds to all interfaces and does not require authentication.
What does an attacker need to exploit this issue?
An attacker needs network access to the agent control-plane HTTP server. No credentials or user interaction are required.
What could an unauthenticated attacker retrieve or change?
An attacker can request /agent/pcap/keylog to obtain NSS keylog lines and decrypt recorded TLS traffic. They can also invoke /agent/stop and /agent/storemocks to manipulate recording sessions.