What happened
Published Aug 30, 2026 with CVSS 8.6 (High). Keploy is a widely-used (18k+ GitHub stars) open-source API-testing/traffic-recording tool that also ships as an MCP server for AI coding agents. Its agent control-plane server exposes TLS session-key material and recording-control endpoints to any network-reachable caller.
Why it matters
Keploy is directly wired into AI coding-agent workflows via MCP (ranked on multiple public MCP-server leaderboards), meaning agent-invoked test recording sessions in CI/dev environments can be hijacked or have their captured TLS traffic decrypted by any attacker who reaches the agent's control plane — a serious information-disclosure and session-tampering risk in agent-driven development pipelines.
Attack vector
Keploy's agent control-plane HTTP server binds to all network interfaces (0.0.0.0) with no authentication. An unauthenticated network attacker can call /agent/pcap/keylog to retrieve live NSS keylog lines and decrypt recorded TLS traffic, or call /agent/stop and /agent/storemocks to manipulate active recording sessions.
Affected systems
Keploy (keploy/keploy) versions 3.1.0 through 3.6.25
Mitigation
Bind the Keploy agent control-plane server to loopback only; do not publish the port (0.0.0.0:<port>) in Docker deployments; add authentication to control-plane endpoints; monitor for vendor patch release.