# CVE-2026-82042: UTMStack authentication bypass via internal API key header

Source: https://junglewise.ai/threats/cve-2026-82042-utmstack-before-11-2-16-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-82042 · Severity: critical · CVSS 9.8 · Published 2026-10-02

UTMStack is a security management platform that aggregates and monitors alerts across infrastructure. An authentication bypass vulnerability allows remote attackers to gain full administrative access to the API by providing a static internal key header, enabling account creation, data exfiltration, and security rule modification without legitimate credentials.

Technologies: [UTMStack](https://junglewise.ai/threats/technologies/utmstack). Vendors: [UTMStack](https://junglewise.ai/threats/vendors/utmstack).

## Quick answers

**Is CVE-2026-82042 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82042 being exploited in the wild.

**How severe is CVE-2026-82042?** Critical severity, with a CVSS score of 9.8, published 2 October 2026.

**Which products and versions are affected?** UTMStack before 11.2.16.

**Is there a fix for CVE-2026-82042?** Yes: fixed in UTMStack 11.2.16. Until then: Restrict the INTERNAL_KEY to known machine-to-machine routes using the INTERNAL_KEY_ALLOWED_CIDRS configuration option to limit exposure to internal networks only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82042 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-82042?** Check whether you run UTMStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in UTMStack 11.2.16

Restrict the INTERNAL_KEY to known machine-to-machine routes using the INTERNAL_KEY_ALLOWED_CIDRS configuration option to limit exposure to internal networks only.

## Technical details

The InternalApiKeyFilter accepts requests with a Utm-Internal-Key header matching the INTERNAL_KEY environment variable for any endpoint without path restrictions, constant-time comparison, or rate limiting. Attackers who obtain the key value (through reconnaissance or compromise) can authenticate to protected API endpoints without a user account or JWT token, gaining administrative privileges to create accounts, manage users, and modify security configurations.

## Affected products

- UTMStack UTMStack before 11.2.16

## Timeline

- 2026-10-02: disclosed
- 2026-10-01: patched: v11.2.16 released; fix committed 2026-08-31

## References

- [https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16](https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16)
- [https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd](https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd)

## Related threats

- [UTMStack JPQL injection via network scan property search](https://junglewise.ai/threats/cve-2026-82045-utmstack-before-11-2-16-contains-a-jpql-injection-vulnerability)
- [UTMStack server-side request forgery in PDF generation](https://junglewise.ai/threats/cve-2026-82044-utmstack-before-11-2-16-contains-a-server-side-request-forgery)
- [UTMStack account enumeration via password reset endpoint](https://junglewise.ai/threats/cve-2026-82043-utmstack-before-11-2-16-contains-an-account-enumeration)
- [UTMStack missing authorization in incident command websocket](https://junglewise.ai/threats/cve-2026-82041-utmstack-before-11-2-16-contains-a-missing-authorization)
- [UTMStack server-side request forgery in IdentityProviderService](https://junglewise.ai/threats/cve-2026-82040-utmstack-before-11-2-16-contains-a-server-side-request-forgery)