VulnSocial

CVE-2026-82641Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-30: 1Patch / Workaround · 2026-08-30: 1Technical Details · 2026-08-30: 108-30
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨HIGH - Keploy Agent Control-Plane Exposure Leaks TLS Session Keys (CVE-2026-82641) Keploy agent control-plane HTTP server is unauthenticated and bound to 0.0.0.0, exposing /agent/pcap/keylog to stream NSS keylog TLS session keys and traffic metadata. Remote attackers can decrypt captured TLS traffic and can hit /agent/stop or /agent/storemocks to disrupt/manipulate recording sessions. 👉Affected: http://go.keploy.io/server/v3 3.1.0-3.6.25 | No patched release published yet (fix is available upstream in commit a6257d2).

    Post summary

    The post reports a newly disclosed CVE-2026-82641 in Keploy's control‑plane exposing TLS session keys with no patch yet released, but it provides no evidence of active exploitation or PoC.

    00000100
    296 followersView on X

Explore more

Back to dashboard