CVE-2026-82641

Keploy versions 3.1.0 through 3.6.25 expose the agent's control-plane HTTP server by binding it to all network interfaces with no authentication (CWE-306), leaving its API endpoints reachable from any network that can reach the host. An attacker with network access to an affected machine can call /agent/pcap/keylog to stream the NSS keylog lines Keploy produces during recording, obtaining TLS session keys that allow decryption of captured TLS traffic. The same unauthenticated surface also lets the attacker invoke /agent/stop and /agent/storemocks, manipulating or disrupting recording sessions and the mock data they capture. Any user running an affected Keploy release, typically on developer workstations, test environments, or CI runners, is affected, particularly where the host sits on a shared or multi-tenant network. No public proof-of-concept, KEV listing, or reported in-the-wild exploitation is known, and EPSS currently puts the 30-day exploitation probability at just 0.4%.

What to do: Upgrade to Keploy 3.6.26 or later, which fixes the issue. Until upgraded, restrict access to the agent's control-plane HTTP server with a host firewall or by limiting it to localhost, since any peer that can reach the host can pull live TLS session keys or disrupt recording sessions. Check which hosts run affected versions and whether they sit on shared networks, and consider that TLS traffic recorded on those hosts could have been decrypted by anyone with network reachability.