keploy 3.1.0 through 3.6.25 binds the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Remote attackers can hit /agent/pcap/keylog to retrieve NSS keylog lines and decrypt recorded TLS traffic, or call /agent/stop and /agent/storemocks to manipulate recording sessions. No patched release published yet (fix is available upstream in commit a6257d2 ).