UTMStack vulnerabilities
We track 4 vulnerabilities in UTMStack products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 2, 2026.
Latest UTMStack vulnerabilities
- 7.7 High severity
UTMStack: Server-Side Request Forgery
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed vi
- 9.8 Critical severity
UTMStack: Missing Authentication for Critical Functionality
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalAp
- 9.9 Critical severity
UTMStack: Missing Authorization
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding suppl
- 8.8 High severity
UTMStack: Improper Neutralization of Special Elements used in an SQL Command
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a n