CVE-2026-82641CWE-306

CVE-2026-82641

High · published August 30, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00595 · 47.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-30T18:17Z
References (6)
https://github.com/keploy/keploy/commit/a6257d2b3184b85eb30edad345464aa292297b83 · [email protected]https://github.com/keploy/keploy/pull/4451 · [email protected]https://github.com/keploy/keploy/releases/tag/v3.6.26 · [email protected]https://github.com/keploy/keploy/security/advisories/GHSA-p79c-x224-cv8h · [email protected]https://www.vulncheck.com/advisories/keploy-3.1.0-through-3.6.25-unauthenticated-tls-key-exposure · [email protected]https://github.com/keploy/keploy/issues/4394 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 30 AUG 13:23Z
    keploy 3.1.0 through 3.6.25 Unauthenticated TLS Key Exposure
    cvelistv5