UTMStack versions earlier than 11.2.16 contain a flaw that allows remote attackers to present an HTTP header named Utm-Internal-Key containing the value of the INTERNAL_KEY environment variable. The InternalApiKeyFilter accepts this header for any endpoint without restrictions, using a simple comparison that lacks constant‑time timing defensives, rate limiting or audit logging. As a result, an attacker who knows the internal key bypasses all user authentication checks and gains full administrative access to the API. With this access they can create accounts, manage users, exfiltrate data and modify security rules. The weakness corresponds to CWE‑306, Improper Authentication.

The vulnerability affects the UTMStack product from the vendor UTMStack, specifically all releases prior to version 11.2.16. Any installation running a version less than 11.2.16 is exposed.

The CVSS score of 9.3 classifies this flaw as critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at the time of analysis. The likely attack vector is remote: an attacker capable of sending HTTP requests can supply the accurate Utm-Internal-Key header to trigger the bypass. Because the key value is matched directly without additional checks, possession of the key is the primary prerequisite. An attacker could obtain the key through exposed environment variables, configuration files or source repositories. Once the key is known, the attacker can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules with administrative privileges.