CVE-2026-82042
CriticalCVSS 9.8Summary
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value. The InternalApiKeyFilter accepts this key for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.
Risk Assessment
Obtaining the INTERNAL_KEY value allows an attacker to fully take over UTMStack administration without a user account. This enables account creation, data exfiltration, and modification of security rules, leading to complete system compromise.
Recommendation
Upgrade UTMStack to version 11.2.16 or later. Protect and rotate the INTERNAL_KEY value and restrict network access to the API to trusted sources only.
Other vulnerabilities in UTMStack
See all- CVE-2026-82045Medium
UTMStack before 11.2.16 contains a JPQL injection vulnerability. An authenticated attacker can read arbitrary entity data by injecting malicious JPQL through the value parameter in the GET /api/utm-network-scans/searchPropertyValues endpoint, as the query is built with String.format() without parameter binding.
- CVE-2026-82044High
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.
- CVE-2026-82043Medium
UTMStack before 11.2.16 contains an account enumeration vulnerability. An unauthenticated attacker can determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint.
- CVE-2026-82040Medium
UTMStack before 11.2.16 contains a server-side request forgery (SSRF) vulnerability in IdentityProviderService.validateMetadataUrl(). An authenticated attacker can make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the identity-providers endpoint.
- CVE-2026-82039High
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder(). An authenticated attacker can inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query. The GET /api/utm-asset-groups/searchGroupsByFilter endpoint can be exploited to execute arbitrary SQL with DBA privileges.
- CVE-2026-82041Critical
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, resulting in command execution on monitored endpoints where agent processes commonly run as root or SYSTEM.
Original NVD description (English source)
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS