CVE-2026-82042 | BDVDB-2026-382162 Detail

Description#

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-02Record published in the CVE List.
2. Version 22026-10-05Most recent update recorded in the CVE List.