Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

UTMStack lets attackers access admin API with internal key

CVE-2026-82042 · published 16 days ago
Summary

UTMStack versions before 11.2.16 accept a special internal key header without checking who sent it. If someone discovers that key, they can log in as an administrator through the API, create or delete user accounts, steal data, and change security settings. Update to version 11.2.16 or later, or remove the internal key usage, to stop this risk.

What to do
  • Update utmstack utmstack to version 11.2.16 or later.
Affected software
VendorProductAffected versions
utmstack utmstack < 11.2.16
Original advisory text
UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-82042 · NVD
CVE-2026-82042 · MITRE
CVE-2026-82042 · OSV
Track software like this
Free during beta