Skip to content
OpenAdvisories

Vendor

UTMStack

7 known vulnerabilities.

Products

UTMStack 7
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-82042

    UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter

    UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalA…

    UTMStack UTMStack
  • Critical 9.9
    CVE-2026-82041

    UTMStack < 11.2.16 Missing Authorization via Command WebSocket

    UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supp…

    UTMStack UTMStack