{"id":"CVE-2026-82042","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-82042","summary":"UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header…","details":"UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.","published":"2026-10-02T21:16:56.643","modified":"2026-10-02T21:16:56.643","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","label":"utmstack/UTMStack@4e7a727"},"references":[{"type":"WEB","url":"https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16"},{"type":"WEB","url":"https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/utmstack-authentication-bypass-via-internalapikeyfilter"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-02T21:16:56.643"}}