Vulnerability · Published Aug 30, 2026 · Assigned by VulnCheck

CVE-2026-82641Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure

High 8.6

In plain English

A high-severity missing authentication in Keploy from Keploy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.6%top 51.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

Affected products (as reported)

Vendor	Product	Versions
Keploy	Keploy	3.1.0 – through 3.6.25

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

GitHub Security Advisory (GHSA-p79c-x224-cv8h) vendor-advisory
Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
VulnCheck Advisory third-party-advisory
https://github.com/keploy/keploy/issues/4394 exploit