CVE-2026-82042 UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
Remote attackers can bypass authentication and gain full administrative API access by presenting a valid internal key header, allowing account creation and data exfiltration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82042?
CVE-2026-82042 is a critical authentication bypass vulnerability in UTMStack, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.
Weakness: CWE-306
Which versions are affected by CVE-2026-82042?
How do I fix CVE-2026-82042?
No fix has been published for CVE-2026-82042 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-82042 being exploited?
There is no known exploitation of CVE-2026-82042 in the wild and no public exploit code.
Sources
Also known as GHSA-phx4-fx7q-vfw9.