Skip to content

v3.6.26

Choose a tag to compare

View all tags
@slayerjain slayerjain released this 31 Aug 06:39
· 5 commits to main since this release
v3.6.26
f99cf34
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔒 Security

This release fixes CVE-2026-82641 (CVSS 3.1: 8.6, High). In keploy 3.1.0 through 3.6.25 the agent's control-plane HTTP server bound to all interfaces without authentication, exposing GET /agent/pcap/keylog (streams live TLS session keys, allowing decryption of recorded traffic) and POST /agent/stop / POST /agent/storemocks (session termination and mock tampering). All users on 3.1.0–3.6.25 should upgrade to 3.6.26. Fixed in #4451 — native mode now binds 127.0.0.1 only, docker mode publishes the port to host loopback exclusively, and Kubernetes DaemonSet mode skips the inbound server.

What's Changed

  • fix(proxy): classify Winsock errors so Windows stops 502ing on resets by @slayerjain in #4481
  • fix(agent): bind control-plane HTTP server to loopback only by @DearMoon50 in #4451
  • fix(mock): drain trailing mocks before tearing the capture stream down by @slayerjain in #4502

Full Changelog: v3.6.25...v3.6.26

Contributors

slayerjain and DearMoon50
Assets 6
Loading