Redpanda CVE-2026-82266

Exploitation requires only network reachability to the Redpanda Admin API on TCP port 9644 while the shipped defaults are in effect: admin_api_require_auth set to false (the default) and the Admin API listener bound to 0.0.0.0 (the default in conf/redpanda.yaml). No credentials, user interaction, or special client are needed against a default-configured instance. The limiting factors are entirely deployment-driven - exploitation is prevented if the operator has set admin_api_require_auth to true, re-bound the listener to localhost or a private interface, or firewalled port 9644 to a trusted management network; conversely, any deployment that left these defaults and exposed 9644 to an attacker-reachable network is exploitable.

This is a genuine high-priority issue rather than an inflated CVSS score: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes fully unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact, and it is entirely consistent with the description's insecure default. The dangerous combination is a default-open bind address (0.0.0.0) plus a default-off authentication flag, which means many deployments are vulnerable out of the box unless operators explicitly hardened them or placed the port behind network controls; a mid-sized operator running Redpanda at the edge of a flat network should treat any Internet- or broadly-LAN-exposed 9644 port as urgent. Tempering the urgency, there is no CISA KEV listing and no public exploit code identified, so exploitation is at present a demonstrated-plausible rather than actively-observed threat, and real-world exposure depends heavily on whether the Admin API port is network-reachable versus firewalled to localhost or a management subnet. EPSS data was not provided, so probabilistic exploitation likelihood could not be factored in and should be checked before final prioritization.

An attacker who can route to a Redpanda host's port 9644 sends an unauthenticated HTTP request to the Admin API and is treated as a superuser without any credentials. From there they create a broker account for persistence, rewrite cluster configuration, and disrupt partition replication to degrade or deny the streaming service. No public proof-of-concept is identified, but the low-complexity, unauthenticated network vector makes exploitation trivial once the port is reachable.