CVE-2026-82641

Name of the Vulnerable Software and Affected Versions keploy versions 3.1.0 through 3.6.25

Description The agent control-plane HTTP server is bound to all interfaces without authentication. This exposure allows remote attackers to access the '/agent/pcap/keylog' endpoint to retrieve NSS keylog lines, which can be used to decrypt recorded TLS traffic. Additionally, attackers can invoke the '/agent/stop' and '/agent/storemocks' endpoints to disrupt or manipulate recording sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.