EUVD-2026-68217
GHSA-wjmh-q7rf-cj53
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint (AV:N/PR:N/AC:L); no scope change; high confidentiality from TLS key exfiltration; low integrity/availability from session manipulation only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.
AnalysisAI
Unauthenticated exposure of live TLS session keys in Keploy 3.1.0-3.6.25 allows any network-reachable attacker to decrypt recorded application TLS traffic by calling the agent control-plane's /agent/pcap/keylog endpoint, which streams NSS keylog lines without any authentication gate. The root cause is the agent HTTP server binding to 0.0.0.0 (all interfaces) rather than loopback, as confirmed by the patch commit diff. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The keploy agent must be actively running in record or replay mode, which is what starts the control-plane HTTP server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L) correctly characterizes this as a low-complexity, unauthenticated network attack with high confidentiality impact - the exposure of TLS session keys is as sensitive as it gets for a traffic-interception tool, since key material enables retroactive decryption of any traffic captured while the agent was running. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a version of Keploy incorporating patch commit a6257d2b3184b85eb30edad345464aa292297b83 (https://github.com/keploy/keploy/commit/a6257d2b3184b85eb30edad345464aa292297b83), which restricts the agent server to loopback (127.0.0.1) in native mode and restricts Docker port publishing to the host's loopback interface. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today