keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that… (CVE-2026-82641)

Keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints such as /agent/pcap/keylog, /agent/stop, and /agent/storemocks. Attackers can access the /agent/pcap/keylog endpoint to obtain NSS keylog lines, enabling decryption of recorded TLS traffic. Additionally, the /agent/stop and /agent/storemocks endpoints allow attackers to interfere with recording sessions. This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function).

An unauthenticated attacker with network access to the agent control-plane HTTP server can retrieve TLS session keys, allowing decryption of TLS traffic, compromising confidentiality. The attacker can also manipulate recording sessions, impacting integrity and availability. The CVSS score is 8.6 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with partial integrity and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the agent control-plane HTTP server to trusted hosts only and consider disabling or firewalling the exposed endpoints to prevent unauthorized access.