Description
Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Keploy | Keploy | 3.1.0 – ≤ 3.6.25 | 3.6.26 |
References
- GitHub Security Advisory (GHSA-p79c-x224-cv8h) vendor-advisory
- Keploy 3.6.26 Release Notes release-notes
- Pull Request issue-tracking patch
- Patch Commit patch
- VulnCheck Advisory third-party-advisory