Keploy Agent Control Plane Unauthenticated TLS Traffic Exposure

Executive Summary

CVE-2026-82641 affects keploy versions 3.1.0 through 3.6.25. The agent control-plane HTTP server binds to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access /agent/pcap/keylog to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

Useful 0 Not Useful 0

Detection Guidance

Check if the Keploy agent is running and listening on all interfaces by running: netstat -tulnp | grep keploy or ss -tulnp | grep keploy. If the agent is bound to 0.0.0.0 without authentication, it is vulnerable. Verify the version with keploy version and check if it falls between 3.1.0 and 3.6.25.

Inspect network traffic for unauthorized access to endpoints like /agent/pcap/keylog, /agent/stop, or /agent/storemocks using tools like curl or Wireshark. Test local access with curl http://localhost:8080/agent/pcap/keylog.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive TLS session keys and decrypt recorded traffic. They can also terminate recording sessions or inject mock data, compromising the integrity of API and integration tests. The exposure occurs locally or via Docker host interfaces.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes TLS session keys and traffic data without authentication, violating data confidentiality requirements in GDPR and HIPAA. Unauthorized access to TLS keys enables decryption of sensitive communications, directly conflicting with GDPR's data protection principles and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Keploy to a patched version where the agent binds only to 127.0.0.1. If upgrading is not possible, restrict the agent server to localhost by modifying the configuration or startup command.

Block external access to the agent port using firewall rules. For Docker deployments, ensure the published port is restricted to 127.0.0.1. Avoid running the agent in privileged modes or with unnecessary network access.

Useful 0 Not Useful 0