UTMStack: Authentication bypass via internal API key
Summary
UTMStack before 11.2.16 accepts the internal Utm-Internal-Key header for any API endpoint and grants full administrative access when it matches the INTERNAL_KEY environment variable. An attacker who obtains the key value can act without a user account or JWT, for example to create accounts, manage users, export data and change security rules. The CVE record lists the flaw as remotely exploitable without authentication, and the fix is available in version 11.2.16.
Affected
- UTMStack versions before 11.2.16
- Version 11.2.16 and later are not affected
Fixed in
- Upgrade to UTMStack 11.2.16 or later (fix commit 4e7a727 and release v11.2.16)
Workaround
- Unknown. The CVE record lists no workaround.
- Restrict access to the UTMStack web and API interface by IP or keep it off the public internet until the upgrade is complete.
Exploitation
- No confirmed exploitation in the wild found in the sources. Not verified against the CISA KEV catalogue.
- No public exploit code has been confirmed.
- EPSS score 0.00546 (low).
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Check whether UTMStack is deployed and which version runs.
- Upgrade to 11.2.16 or later immediately, together with the other fixes in the same release.
- If the instance was reachable from the internet, rotate the INTERNAL_KEY value after the upgrade.
- Review accounts, security rules and logs for unexpected administrative changes, as the bypass leaves no audit trail.
- Keep the interface off the public internet or restrict it by IP.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- UTMStack release v11.2.16 github.com
- UTMStack fix commit 4e7a727 github.com
- OpenCVE CVE-2026-82042 app.opencve.io
- OSV CVE-2026-82042 osv.dev
- TheHackerWire CVE-2026-82042 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:34.
Original description (NVD)
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.