Description

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-30T14:17:04.020Z",
  "pubdate": "2026-08-30T14:17:04.020Z",
  "executiveSummary": "Keploy versions 3.1.0 through 3.6.25 contain a critical security vulnerability involving the improper configuration of the agent control-plane HTTP server. The server is bound to all network interfaces (0.0.0.0) without requiring any form of authentication, effectively exposing sensitive administrative and diagnostic endpoints to any actor with network access.\nThis exposure allows unauthorized remote parties to intercept sensitive cryptographic material, specifically NSS keylog lines, which facilitate the decryption of intercepted TLS traffic. Furthermore, the lack of access controls permits unauthenticated attackers to manipulate the lifecycle of recording sessions by invoking arbitrary control-plane functions such as stopping services or committing mock data. The vulnerability presents a severe risk to data confidentiality and service integrity, as it allows for both passive traffic analysis and active disruption of the Keploy recording process. Exploitation does not require prior knowledge or specialized credentials, as the endpoints are reachable directly over the network via standard HTTP requests. Organizations deploying Keploy in environments where the control-plane interface is reachable from non-trusted networks are at high risk of credential harvesting and session manipulation.",
  "technicalDetails": "The root cause of this vulnerability is the insecure default configuration of the Keploy agent's HTTP control-plane server, which binds to all available network interfaces rather than restricting access to the loopback address (127.0.0.1) or enforcing mandatory authentication. By failing to implement an authorization layer, the application leaves critical diagnostic and operational endpoints publicly accessible to any entity capable of routing packets to the host.\nThe primary security failure manifests at the /agent/pcap/keylog endpoint. In standard operation, this endpoint provides access to NSS keylog data. When exposed without authentication, an attacker can perform a GET request to this path to retrieve the TLS session keys generated by the application. By capturing these keylog lines, an attacker can decrypt recorded TLS traffic, effectively bypassing the security provided by encrypted transport protocols.\nFurthermore, the control-plane server exposes administrative endpoints including /agent/stop and /agent/storemocks. These functions permit unauthorized actors to interact with the agent's internal state. An attacker can send HTTP requests to these endpoints to forcibly terminate recording sessions or trigger the storage of mock data, enabling a denial-of-service scenario or the corruption of captured testing data.\nThe exploitation flow is straightforward: 1) The attacker performs network reconnaissance to identify the Keploy agent's control-plane port. 2) Upon identifying the reachable service, the attacker issues unauthenticated HTTP requests to the target endpoints. 3) The agent processes these requests, returning sensitive TLS keying material or executing management commands without verifying the origin or legitimacy of the caller.\nThe attack surface is expanded by the fact that the service is exposed to all interfaces, meaning any device on the network segment—or potentially the public internet if the host is misconfigured—can interface with the agent. Because the API lacks authentication headers or mutual TLS verification, the exploit is trivial to execute using common tools such as curl or automated scripts. The impact is significant: the exposure of the keylog data renders the encryption of intercepted traffic moot, and the ability to stop sessions or commit mock data allows for targeted disruption of development and testing pipelines, leading to potential data integrity issues in the downstream testing infrastructure."
}