CVE-2023-52251

HighCVSS 8.8

Published: 25/01/2024(UTC)Updated: 08/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

85.03%

100th percentile - higher than 100% of all known CVEs

Summary

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. No fixed release is available; the project has had no commit since 2024-04-08.

Risk Assessment

An attacker can remotely execute arbitrary code on the server, potentially leading to full system compromise, data theft, or service disruption. The lack of a patch increases the risk of exploitation.

Recommendation

It is recommended to immediately restrict access to the application and monitor network traffic. Consider disabling or replacing kafka-ui with another tool until an official fix is available.

Other vulnerabilities in provectus kafka-ui

CVE-2026-78166Medium
A security flaw was discovered in provectus kafka-ui up to 0.7.2 in the executeSmartFilterTest function of kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the Groovy Code Handler component. The manipulation results in code injection. The attack can be launched remotely, and the exploit has been released.

Original NVD description (English source)