EUVD-2026-67797
GHSA-qp5m-mrqw-6pxr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Default insecure config allows unauthenticated network callers superuser control, so AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.
AnalysisAI
Authentication bypass in Redpanda through version 26.2.2 exposes the cluster Admin API on 0.0.0.0:9644 with admin_api_require_auth defaulting to false, so any request reaching that port is silently treated as a superuser. Unauthenticated network attackers can create and delete broker accounts, rewrite cluster configuration, and disrupt partition replication, giving them full administrative control of the streaming platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the Redpanda Admin API on TCP port 9644 while the shipped defaults are in effect: admin_api_require_auth set to false (the default) and the Admin API listener bound to 0.0.0.0 (the default in conf/redpanda.yaml). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes fully unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact, and it is entirely consistent with the description's insecure default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so remediation should center on configuration hardening and network controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit firewall and network access logs for external traffic to port 9644; immediately implement firewall rules restricting Admin API access to authorized administrator IP ranges only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API. Rated critic
Redpanda before 22.3.12 discloses cleartext AWS credentials. Rated medium severity (CVSS 5.5), this vulnerability is low
rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today