CVE-2026-82042

9.8 CRITICALpublic exploit available

Published 2026-10-02 · Updated 2026-10-06

AI risk analysis

Summary: UTMStack before 11.2.16 allows remote attackers to bypass authentication by using a valid Utm-Internal-Key header, gaining full administrative API access.
Exploitability: Exploitation is relatively straightforward if the attacker has access to the Utm-Internal-Key header value, which can be obtained through various means.
Blast radius: Exploitation could lead to complete control over the UTMStack system, including account creation, user management, data exfiltration, and rule modification, with severe real-world impact.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to UTMStack 11.2.16 or later.

auth-bypassapiadminweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.