CVE-2025-60537
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data. The flaw results from insufficient validation of input before processing.
Risk Assessment
An attacker can execute arbitrary code in the context of the kafka-ui application, potentially leading to system compromise and access to Kafka data. This may also enable further attacks on the infrastructure.
Recommendation
Update kafka-ui to a patched version (later than v0.7.2). Restrict access to the kafka-ui interface and validate input in serde loader components.
Other vulnerabilities in kafka-ui
See all- CVE-2024-32030High
Kafka UI, an open-source web UI for Apache Kafka management, allows users to connect to different Kafka brokers and monitor their performance via JMX ports. JMX is based on the RMI protocol, which is inherently susceptible to deserialization attacks. An attacker can exploit this feature by connecting the Kafka UI backend to a malicious broker, potentially leading to remote code execution (RCE). The vulnerability affects deployments where dynamic.config.enabled is set or where an attacker has access to the Kafka cluster connected to Kafka UI.
- CVE-2026-5562High
In provectus kafka-ui up to version 0.7.2, the function validateAccess in /api/smartfilters/testexecutions is vulnerable to code injection. The attack can be initiated remotely, and the exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS