CVE-2026-82266CWE-306

CVE-2026-82266

Critical · published August 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-29T00:20Z
References (5)
https://github.com/redpanda-data/redpanda · [email protected]https://github.com/redpanda-data/redpanda/blob/3cfce474a872090e7c74d14181885f5838c54cf2/conf/redpanda.yaml · [email protected]https://github.com/redpanda-data/redpanda/blob/3cfce474a872090e7c74d14181885f5838c54cf2/src/v/security/request_auth.cc · [email protected]https://github.com/redpanda-data/redpanda/issues/30989 · [email protected]https://www.vulncheck.com/advisories/redpanda-admin-api-unauthenticated-superuser-access-via-default-configuration · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:18Z
    Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
    cvelistv5