Klaw CVE-2026-45080

No special conditions are required for initial access - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Klaw. The attacker needs only network reachability to the Klaw web interface. Exploitation is limited by the following factors: the deployment must be running a Klaw version prior to 2.10.4; impact is bounded to password hash disclosure (VC:L) rather than full credential or data compromise; and successful credential recovery from the hash depends on the hashing algorithm strength and password complexity used within the Klaw instance. There is no requirement for a specific Kafka configuration, topic setup, or Klaw feature flag - the vulnerability exists in the access control layer of the portal itself.

The CVSS 4.0 base score of 6.9 reflects a network-accessible, low-complexity, zero-privilege attack with low confidentiality impact to the vulnerable component (VC:L) and no integrity or availability impact. While the score is moderate, several factors elevate practical risk: the PR:N/UI:N combination means fully automated, unauthenticated exploitation is possible with no victim interaction required. Password hashes, once obtained, enable offline brute-force or dictionary attacks, potentially yielding plaintext credentials that could be reused across systems (credential stuffing risk). The actual risk therefore scales with the strength of the hash algorithm used by Klaw - if weak or unsalted hashing is employed, hash disclosure may effectively equal credential disclosure. Conversely, risk is bounded by VC:L rather than VC:H, suggesting the disclosure may be partial (e.g., hashes without usernames, or hashes for a limited user subset). No KEV listing and no public exploit code exists at time of analysis, and EPSS data was not provided in the intelligence feed. This issue is a real priority for any internet-facing Klaw deployment, less so for tightly network-restricted internal instances.

An unauthenticated attacker with network access to the Klaw web portal sends a crafted HTTP request to the unprotected endpoint responsible for the hash disclosure. The server responds with one or more user password hashes, which the attacker then subjects to offline dictionary or brute-force cracking. If successful, recovered plaintext credentials may be used to log into Klaw directly or attempted against other services if the user reused their password. No public exploit code has been identified at time of analysis, but the attack requires only basic HTTP tooling given the unauthenticated network vector.