Redpanda
Monthly
Authentication bypass in Redpanda through version 26.2.2 exposes the cluster Admin API on 0.0.0.0:9644 with admin_api_require_auth defaulting to false, so any request reaching that port is silently treated as a superuser. Unauthenticated network attackers can create and delete broker accounts, rewrite cluster configuration, and disrupt partition replication, giving them full administrative control of the streaming platform. Rated CVSS 4.0 9.3 (Critical); no public exploit or active exploitation has been identified at time of analysis.
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Redpanda before 22.3.12 discloses cleartext AWS credentials. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in Redpanda through version 26.2.2 exposes the cluster Admin API on 0.0.0.0:9644 with admin_api_require_auth defaulting to false, so any request reaching that port is silently treated as a superuser. Unauthenticated network attackers can create and delete broker accounts, rewrite cluster configuration, and disrupt partition replication, giving them full administrative control of the streaming platform. Rated CVSS 4.0 9.3 (Critical); no public exploit or active exploitation has been identified at time of analysis.
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Redpanda before 22.3.12 discloses cleartext AWS credentials. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.