Auth bypass in Keploy
CVE-2026-82641
Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.006 (47.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002
Affected products
Weakness classification (CWE)
References
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (issue-tracking)
- github.com/keploy/keploy (product)
- github.com/keploy/keploy/blob/v3.6.25/pkg/agent/routes/server.go (technical-description)
- github.com/keploy/keploy/commit/a6257d2b3184b85eb30edad345464aa292297b83 (patch)
- www.vulncheck.com/advisories/keploy-3.1.0-through-3.6.25-unauthenticated-tls-ke… (third-party-advisory)
- github.com/keploy/keploy/pull/4451 (issue-tracking)
- github.com/keploy/keploy/releases/tag/v3.6.26 (release-notes)
- github.com/keploy/keploy/security/advisories/GHSA-p79c-x224-cv8h (vendor-advisory)
Frequently asked questions
- What is CVE-2026-82641?
- CVE-2026-82641 is a high-severity vulnerability in Keploy, classified under Missing Authentication for Critical Function. CVSS score: 8.6/10. Published 2026-08-30.
- How severe is CVE-2026-82641?
- High severity. CVSS v3 base score is 8.6 out of 10.