CVE-2026-82042
- Source
- https://cve.org/CVERecord?id=CVE-2026-82042
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82042.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-82042
- Published
- 2026-10-02T20:15:27Z
- Modified
- 2026-10-04T07:05:10Z
- Severity
-
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
- Details
-
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-306" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82042.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82042.json
- https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16
- https://nvd.nist.gov/vuln/detail/CVE-2026-82042
- https://www.vulncheck.com/advisories/utmstack-authentication-bypass-via-internalapikeyfilter
- https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd
- https://github.com/utmstack/UTMStack
Affected packages
Git / github.com/utmstack/utmstack
Affected versions
v10.*
v10.1.0-202311061514
v10.1.0-202312131645
v10.2.3-202402162310
v10.4.0-202404241632
v10.4.1-202405031218
v10.4.1-202405031709
v10.4.2-202405091759
v10.4.3-202405302135
v11.*
v11.0.0
v11.0.0-beta.1
v11.0.0-beta.2
v11.0.1
v11.0.2
v11.0.3
v11.1.0
v11.1.1
v11.1.2
v11.1.3
v11.1.4
v11.1.5
v11.1.6
v11.1.7
v11.1.8
v11.2.0
v11.2.1
v11.2.10
v11.2.11
v11.2.12
v11.2.13
v11.2.14
v11.2.15
v11.2.2
v11.2.3
v11.2.4
v11.2.5
v11.2.6
v11.2.7
v11.2.8
v11.2.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82042.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "68957226723480356561986649724453577436",
"length": 2994
},
"id": "CVE-2026-82042-00f80de3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java",
"function": "searchQueryBuilder"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "269564747755058024608506188991266501520",
"length": 917
},
"id": "CVE-2026-82042-07391e93",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java",
"function": "searchGroupsByFilter"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "70773812559973059244528242160102601958",
"length": 3689
},
"id": "CVE-2026-82042-0793b236",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/a310ff00d4f699cf0ae687573f43b69ad9906cdb",
"target": {
"file": "backend/src/main/java/com/park/utmstack/config/SecurityConfiguration.java",
"function": "configure"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "194282840324961909787801722715739979943",
"length": 1480
},
"id": "CVE-2026-82042-4294df97",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/web/rest/incident_response/UTMIncidentCommandWebsocket.java",
"function": "processCommand"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "122915742089848104480121812621346897408",
"length": 1220
},
"id": "CVE-2026-82042-4780dfe6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/network_scan/UtmNetworkScanService.java",
"function": "searchPropertyValues"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"77603615067398617732982454417074115968",
"304720162881483557242953176377370407015",
"260776442570540419608668916007901239293",
"262102178570292902976957050882384933105",
"5133484940078305098189227038033073533",
"263277958095074705452565142646991028649",
"227581039705041739629317629530014128943",
"134473599757741699577048779550965553856",
"71466108699213875496886080697458899142",
"87786911152576521695650543567066976037",
"135355826422831744092394526397570149502",
"244654325976399233910958718223927104902",
"251793201619877621403247205321511205954"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-5deb7938",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/network_scan/UtmNetworkScanService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "252342772753674335335270762340879727604",
"length": 795
},
"id": "CVE-2026-82042-6a696dc3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/security/internalApiKey/InternalApiKeyFilter.java",
"function": "doFilterInternal"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"241115389385701311286308295943062964888",
"76201888586539675433739520760521457351",
"261236661973030783745185757318799114339",
"231012732014062826357513291716763460230",
"298941622871660510446773221493330129626",
"172411567710169248654347324730101481300",
"157215274910122719066831341524769260078",
"282970919829637986708352856687313473143",
"56511641352748286300733203307840306542",
"319863484281315374448378692454963485023",
"216615871232047482882774231037738458355",
"44870638661576000866040676905112114558",
"4233876062808691743390062311096270384",
"246908052710003740064611322348159714725",
"4323070435631480266204958908739082756",
"158987343302283832856824801036361737249",
"58979048005994418837395826113763732584",
"60047552708223396388281488984772081475",
"196923943742214301359447423096082991214",
"210638623208098108922079142945477430121",
"234489763707159543675782021424876966286"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-702c7130",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/security/internalApiKey/InternalApiKeyFilter.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"277039843628984667651694344387966319114",
"23668358656342241489460181213357334917",
"310918558045884477827052763127165867619",
"285454521102060390935400870517333241103",
"200888499468995779898647337043322223148",
"189458530986277879553087431244132497592",
"96318959497276070722390765069646232309",
"199402746966899601354456020533487009591",
"245168938035553143552106125998119538687",
"226412059791457723713196864340388154134",
"111501204007924803053680676712757688355",
"68474151969105336051116614703243405798",
"271815970607579177472625077476098408513",
"124437263763259485212241888798773767275",
"74760391624223906666366499671270148882",
"50007932177270992536116050006623892353",
"24068247171127542514218832625446638352",
"4483026928201441949587531436333086328",
"139276222224272416397991124107459273544",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-72af4e36",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/idp_provider/IdentityProviderService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "21715359993335467388544530975700947048",
"length": 764
},
"id": "CVE-2026-82042-81091f13",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java",
"function": "paginateAndSort"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"55656280868562036959218950542431658586",
"155802045640653480201339051028028542201",
"284745671717788103914269017129057686491",
"261947612099601736708344571355368216831",
"9759751298826789821120752736318237593",
"245774701065037204139516583684738341968",
"153746669157542053600414596294431907957",
"85508958559698379461484898353092665670",
"239855418990530863508964515992809079924",
"251193954779579154980270933822911195927",
"205640138077953587150281572281945385728",
"178658191973704440316543671677129217542",
"138301922401647249022440471763611583307",
"148831703809696838842935755661676171225",
"199718222039456708886455612341404295624",
"288173854134558466866992639370079114656",
"58959099417506163983999528773981655395",
"759720683040077693387156971630218582",
"7574831424478313946649508111800537018",
"136783642486838001007693227115762087724",
"78644566948244470154787562967268655945"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-925dc6bd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/util/PdfService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "32396492999311826525356307162101200710",
"length": 875
},
"id": "CVE-2026-82042-94e7ed27",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/idp_provider/IdentityProviderService.java",
"function": "validateMetadataUrl"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "212541657921691813231161786274439366480",
"length": 1318
},
"id": "CVE-2026-82042-9b18b619",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/util/PdfService.java",
"function": "downloadPdf"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170461039677711501334178069128019677421",
"3401771017735731825061292563379079810",
"261387076591306151502832519968014278455",
"256757536887397401392918940740419590189",
"277188335890058182537232285740602662233",
"165581889064784955137401457176080878314",
"179227681237092516613927473781687056516",
"29851811868030657649713053241261918471",
"148658634461367178990754064794143772013",
"131300027467541837514452301394165969195",
"303975401781444180210010108399950880225",
"215550974715414801837671602583966164589",
"112893919408313279852858888249889144541",
"257774632175408274051101139981074462979",
"171126406862393019244500554021960428805",
"107117810192417848763701541837764660220",
"13663826385241515065845300110866471083",
"197272913510299630801956516942694805154",
"230663873111406486356025192809036977500",
"38594800997881727573530205446395018118",
"55256096779567928781947751771342434876",
"94684015014019126152408051701184622764",
"178149395944589792708008294244785543821",
"8946013819474954028186090998507019859",
"296196032982810468579032964868328623126",
"245623271910960024966811782637423035012",
"131660213432666327881232600980883982438",
"18858285925719110998534355183255790228",
"192435357750973153079407594523792386937",
"126873467423546733089634590628196549503",
"235381625114333324875872605922488393389",
"142902171119534625869733233398687699730",
"189181004437945000930504869842004519283",
"98836481375444914081571104075629814642",
"173931244521340738203531176242047295299",
"158217824107783012308864330561525166962",
"184005022732245621151110924626562207730",
"108817327070015761144106336568364702145",
"74890120581430093459383767192852167452",
"226483864031302285450434363458042225913",
"18944254368952446308194441223988788568",
"9884300982209535692114794464338551279",
"145313502244303445711839817292934548324",
"197169255933424470690076989450064442175",
"34379051886614623691543370794094743387",
"216879131372612452624410396380885559453",
"103806376805593399755082591366182777923",
"15802898346175297641447624990014065838",
"123108243521830258810309452782617651436",
"66783889553409901717983066984448954955",
"237987917151888528874518718173802672395",
"314405980006118549730532247206740574053",
"273181242102623116769457378905337981832",
"245669837973920413622219619599618448973",
"126114700840759980330039103989282996039",
"238972273345145543423976708731578873908",
"80813088057124992137769293197925288935",
"32118268750087865183887736569806886889",
"175289753221613953552280069820931821418",
"119348768479635086767690364681059718717",
"90186939995202410078373764356704395802",
"75732232990598809370409507532972153424",
"118248706238056451436658937938692744011",
"232407023656820773380683096415522278794",
"24838716015293192799825009527642909513",
"224025494235650520393135159803101914569",
"132313197584908942114433343359477929982",
"170168216353539923718138953195353275213",
"27934368884670534498454909300857609777",
"332238180889592359516214813454353109422",
"92008252781943991993058250065751720314",
"323666141135752267656269940117495011102",
"221006074611266795876844427797044101795",
"30582041256451467405994339976199930330",
"299833960951009686327375785271114804343",
"176182327650921399671415361187662607711",
"254885914770556834404769940335512295140",
"214827608276759893772544067253528189658"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-bcbc599a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"103284467063735408960434712554076057548",
"32184795726974271460158294934079877428",
"58926678751707606193145524128815768052",
"110901320694948366001464244037974520348",
"338319468639382730601321932508553144428",
"103963464031165831410954753771933886733",
"249624847472728353050334293894912960453",
"162863961542199742852783999763095900698",
"330215521513084121184500998173092427078",
"237416822402843818144247785567912425122"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-bf8a31b2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/web/rest/incident_response/UTMIncidentCommandWebsocket.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"119281674686975875731770564032219692959",
"78417934313768657444876122361674007360",
"301640857188330599007503845765622088432",
"64100248194460746321534318893883868353",
"159508737171311465299931082978432811512",
"259289253056643582300184839775532838678",
"95892701269182895559018270523281688726",
"206679843760629120357119700617020291811",
"67364895523386518943973277506961632478",
"155592101035150071756891642905790812940",
"211976529167707917597169646786069468486",
"120236724691976339212976360999125805994",
"311918250049656819494207908605484250358",
"152626673150893568131945532291424565712",
"196236995951032327730232558783122303926"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-d1788db7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/web/rest/AccountResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "20522550395325152084216769065997637140",
"length": 402
},
"id": "CVE-2026-82042-f13c5800",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd",
"target": {
"file": "backend/src/main/java/com/park/utmstack/web/rest/AccountResource.java",
"function": "requestPasswordReset"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"24314465636384831080084381857013409531",
"101145122101593491737521883455940834613",
"21943337672715565972139449547318075074",
"303463960373478848245061352223630480259"
],
"threshold": 0.9
},
"id": "CVE-2026-82042-f7b13804",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/utmstack/utmstack/commit/a310ff00d4f699cf0ae687573f43b69ad9906cdb",
"target": {
"file": "backend/src/main/java/com/park/utmstack/config/SecurityConfiguration.java"
}
}
]
vanir_signatures_modified
"2026-10-04T07:05:10Z"