Is CVE-2026-82641 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82641?

CVE-2026-82641 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-82641

Description

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.