Keploy CVE-2026-82641

The keploy agent must be actively running in record or replay mode, which is what starts the control-plane HTTP server. In native mode on affected versions, the server binds to 0.0.0.0 on the agent port, making it reachable by any local or network-adjacent process - including other users on a shared CI host or attackers with access to the host's network segment. In Docker mode, exposure extends to the host network if the container port is published to 0.0.0.0 (which was the pre-fix default behavior in GenerateKeployAgentService). No credentials, elevated privileges, or user interaction are required once network connectivity to the agent port is established. Exploitation is limited to: (1) deployments actually running the keploy agent process (not passive keploy CLI invocations without agent mode), and (2) environments where the agent port is reachable from an untrusted network context - a developer laptop on an isolated local network with no external exposure faces negligible network-layer risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L) correctly characterizes this as a low-complexity, unauthenticated network attack with high confidentiality impact - the exposure of TLS session keys is as sensitive as it gets for a traffic-interception tool, since key material enables retroactive decryption of any traffic captured while the agent was running. The integrity and availability impacts are appropriately rated low, reflecting that /agent/stop and /agent/storemocks allow session disruption but not persistent system compromise. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. The absence of KEV listing and public POC suggests exploitation has not been observed at scale, though the attack technique is trivial - a single unauthenticated GET request. Practical risk is highest in CI/CD environments where the keploy agent port is inadvertently exposed beyond the test host, or in shared developer machines where local processes from other users could reach the endpoint.

An attacker with network access to a CI/CD runner or developer workstation running keploy agent in affected versions sends a plain HTTP GET to /agent/pcap/keylog on the agent's configured port - no credentials required. The response streams NSS SSLKEYLOGFILE-format TLS session key lines, which the attacker imports into Wireshark alongside previously captured pcap files to decrypt recorded application TLS sessions, exposing API tokens, session cookies, or other sensitive data in transit. No public exploit code has been identified at time of analysis, but the attack requires only curl and a packet capture, both standard on developer systems.