Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-31 · high
The bug sits in a control-plane API bound wide open, and it's the second no-auth agent bind-to-all bug found in three days.
Why now: NVD published the CVE on August 31, days after a similar bug in argocd-mcp.
Keploy's agent control plane will hand over TLS session keys to anyone who can reach it on the network. CVE-2026-82641, rated 8.6, covers versions 3.1.0 through 3.6.25. The control-plane HTTP server binds to all interfaces with no authentication, and one endpoint, /agent/pcap/keylog, returns NSS keylog lines that decrypt any TLS traffic Keploy recorded.
That's a direct path from network access to reading someone else's encrypted sessions. The same unauthenticated surface also exposes /agent/stop and /agent/storemocks, so anyone who finds the port can kill the agent or tamper with its recorded mocks.
This is the second bind-to-0.0.0.0-with-no-auth agent CVE in three days, after argocd-mcp's 10.0. Two unrelated projects made the identical default choice inside one week. Spin up an HTTP server for local convenience, skip auth because it's local only, bind wide because 0.0.0.0 is the framework default.
Running agent tooling with an HTTP control plane means checking two things: what interface it binds to, and whether it requires a credential. Don't assume localhost. Don't assume auth. Twice in three days, the default in this category has been neither.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover CVE, HTTP; reported by the same outlet (nvd.nist.gov); overlapping topics (anyone, bind).
Shared entities / Same source domain / Earlier coverage / Tension
Both cover CVE, HTTP; reported by the same outlet (nvd.nist.gov); earlier CVE coverage from 2026-08-27.
Shared entities / Shared topic / Earlier coverage / Tension
Both cover HTTP, TLS; overlapping topics (agent, control); earlier HTTP coverage from 2026-07-30.
Shared entities / Same source domain / Earlier coverage
Both cover CVE, HTTP; reported by the same outlet (nvd.nist.gov); earlier CVE coverage from 2026-08-28.
Both cover CVE, HTTP; reported by the same outlet (nvd.nist.gov); earlier CVE coverage from 2026-08-28.
Both cover CVE, Versions; reported by the same outlet (nvd.nist.gov); earlier CVE coverage from 2026-08-28.
Shared entities / Shared topic / Earlier coverage
Both cover CVE, HTTP; overlapping topics (agent, bind); earlier CVE coverage from 2026-08-02.
Both cover CVE, HTTP; overlapping topics (agent, bind); earlier CVE coverage from 2026-07-01.