CVE-2025-49127CWE-502

Kafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration

High · published June 6, 2025

CVSS v4.0
8.9
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue.

The record
Technical detail
CVSS v4.0
8.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-06-06T20:23Z
EPSS history
Timeline
  • 06 JUN 20:23Z
    Kafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration
    cvelistv5