Keploy's agent server leaks TLS keys with no login

Keploy's agent control plane will hand over TLS session keys to anyone who can reach it on the network. CVE-2026-82641, rated 8.6, covers versions 3.1.0 through 3.6.25. The control-plane HTTP server binds to all interfaces with no authentication, and one endpoint, /agent/pcap/keylog, returns NSS keylog lines that decrypt any TLS traffic Keploy recorded.

That's a direct path from network access to reading someone else's encrypted sessions. The same unauthenticated surface also exposes /agent/stop and /agent/storemocks, so anyone who finds the port can kill the agent or tamper with its recorded mocks.

This is the second bind-to-0.0.0.0-with-no-auth agent CVE in three days, after argocd-mcp's 10.0. Two unrelated projects made the identical default choice inside one week. Spin up an HTTP server for local convenience, skip auth because it's local only, bind wide because 0.0.0.0 is the framework default.

Running agent tooling with an HTTP control plane means checking two things: what interface it binds to, and whether it requires a credential. Don't assume localhost. Don't assume auth. Twice in three days, the default in this category has been neither.