A critical vulnerability in the Keploy agent allows unauthenticated remote attackers to intercept encrypted traffic and hijack recording sessions.

The application binds its control-plane HTTP server to all network interfaces without requiring authentication. This allows any unauthenticated attacker with network access to interact with sensitive endpoints, such as /agent/pcap/keylog to exfiltrate TLS session keys or /agent/stop to disrupt recording operations.

Successful exploitation permits the decryption of recorded TLS traffic, potentially exposing sensitive data, credentials, and API tokens captured during Keploy sessions. Given the CVSS score of 8.6, this vulnerability poses a severe threat to data confidentiality and integrity, as it allows an attacker to bypass encryption controls and manipulate testing environments without needing prior credentials.

Immediate Action: Restrict network access to the Keploy agent control-plane port to trusted internal management networks only, as a vendor patch is currently unavailable.

Proactive Monitoring: Review network access logs for unusual connections to the Keploy agent port and monitor for unexpected service interruptions or termination of recording sessions.

Compensating Controls: Deploy a Web Application Firewall or network access control list to block unauthorized access to the agent's HTTP port, ensuring only authorized testing infrastructure can interact with the control plane.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk due to the potential for traffic decryption and session manipulation. Organizations currently utilizing Keploy versions 3.1.0 through 3.6.25 should prioritize network isolation of the agent service immediately and monitor official vendor channels for the release of a security patch to address this authentication flaw.