CVE-2026-82042: Utmstack

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.

Affected products

• Utmstack Utmstack: before 11.2.16 (fixed in 11.2.16)

Published 2026-10-02. Last modified 2026-10-06.