EUVD-2026-19071
GHSA-xcqp-9wgc-xxhj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.9 score reflects a moderate-to-high severity rating with unauthenticated network-accessible attack vector (AV:N/PR:N) and low attack complexity (AC:L), indicating minimal barriers to exploitation. The EPSS score is marked P (publicly exploitable), confirming the threat is actively weaponizable. While the vector shows only partial confidentiality/integrity/availability impact (VC:L/VI:L/VA:L), the tags and description indicate code injection leading to remote code execution, a more severe impact than the CVSS impact metrics suggest. The fact that publicly available exploit code exists combined with vendor non-response creates a critical priority situation: organizations running kafka-ui versions 0.7.2 or earlier face immediate risk of compromise with no vendor-supplied patch forthcoming. This is not a low-real-risk high-CVSS issue-it is a genuinely exploitable vulnerability with working public exploits. |
| Exploit ScenarioDerived | An unauthenticated attacker on the internet discovers a kafka-ui instance running version 0.7.2 or earlier via banner grabbing or service scanning. The attacker crafts a malicious payload containing code injection syntax and sends it to the validateAccess endpoint at /api/smartfilters/testexecutions. Due to the lack of input validation in the endpoint and the absence of authentication requirements, the injected code is processed and executed on the server with the privileges of the kafka-ui process, allowing the attacker to establish a reverse shell, exfiltrate Kafka cluster credentials, or pivot to other systems. Publicly available exploit code significantly lowers the barrier for script-kiddie-level attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 05, 2026
Code injection in Provectus kafka-ui up to version 0.7.2 allows unauthenticated remote attackers to execute arbitrary code via the validateAccess function in the /api/smartfilters/testexecutions endpoint. The vulnerability has publicly available exploit code and carries a CVSS 6.9 score reflecting moderate but meaningful real-world risk; the vendor was contacted early but provided no response, suggesting no patch is anticipated.
RemediationAI
Immediate upgrade to a version newer than 0.7.2 is the primary remediation, though no specific patched version is confirmed from available data; organizations should verify the latest available kafka-ui release from the official Provectus repository (https://github.com/provectus/kafka-ui) and test before deployment. If upgrade is not immediately possible, implement network-level access controls to restrict access to the /api/smartfilters/testexecutions endpoint, use reverse proxy authentication to require valid credentials despite the endpoint's lack of built-in auth, and monitor for suspicious payloads in request logs. Reference CVE details available via https://vuldb.com/vuln/355332 for additional mitigation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from unsafe code injection handling (CWE-94: Improper Control of Generation of Code) in the smart filters test executions API endpoint of kafka-ui, a web-based Kafka cluster management tool. The validateAccess function fails to properly sanitize or validate user-supplied input before processing it as code, allowing attackers to inject arbitrary payloads. Kafka-ui is a standalone web UI built in Java/Kotlin for Apache Kafka administration and monitoring, making this endpoint a direct attack surface for remote code execution when improperly secured.
Know when Kafka Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB