kafka-ui CVE-2026-78166

Exploitation requires a valid authenticated session in kafka-ui with access to the message browsing or smart filter test functionality (CVSS PR:L - low privilege). The attacker must be able to reach the kafka-ui web interface over the network (AV:N). The attack targets the executeSmartFilterTest function, which is invoked when a user submits a Groovy filter expression for testing against Kafka topic messages - this feature must be accessible to the attacker's role. No special non-default configuration is required beyond having a running kafka-ui instance with the smart filter feature available, which is a standard capability. Limiting factors: unauthenticated access is not sufficient (PR:L required); if kafka-ui is restricted to administrator roles only, the effective attack surface is reduced to trusted internal users rather than all authenticated personnel.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 and reflects low privileges required with limited impact metrics - likely a conservative vendor or reporter assessment. The provided impact ratings (VC:L/VI:L/VA:L) conflict with the 'RCE' tag: unrestricted Groovy execution on the server typically yields full host compromise, suggesting the impact metrics may be understated and should be independently verified. The E:P (proof-of-concept exists) supplemental metric elevates urgency beyond the base score. No EPSS data was provided. The vulnerability is not listed in CISA KEV, so active exploitation is not confirmed, though the combination of a public PoC, an unresponsive vendor, and no available patch represents a deteriorating risk posture over time. SSVC signals: exploitation is publicly available (Proof of Concept), the attack is automatable (AV:N/AC:L/PR:L), and technical impact is potentially total on the affected system if Groovy execution is unsandboxed. Any environment exposing kafka-ui to internal users without strict role controls should treat this as higher-priority than the base score implies.

An authenticated kafka-ui user with any level of access navigates to the smart filter test interface and submits a crafted Groovy payload - for example, invoking Runtime.exec() - targeting the executeSmartFilterTest endpoint. Because the Groovy engine runs without a restrictive sandbox, the payload executes on the server with the privileges of the kafka-ui process, potentially granting shell access, credential theft, or lateral movement within the Kafka infrastructure. A public proof-of-concept is available via the GitHub issue at https://github.com/provectus/kafka-ui/issues/4567, lowering the skill bar for exploitation.