CVE-2026-45080

MediumCVSS 6.9

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Klaw, an Apache Kafka topic management tool, has an improper access control vulnerability that discloses password hashes. This affects versions prior to 2.10.4.

Risk Assessment

An attacker can obtain password hashes, increasing the risk of user account compromise and further unauthorized access.

Recommendation

Upgrade Klaw to version 2.10.4 or later.

Other vulnerabilities in Klaw

CVE-2026-44367Low
In Klaw, a self-service Apache Kafka Topic Management tool, prior to version 2.10.4, inconsistent handling of username case sensitivity in registration and login mechanisms allows a targeted Denial of Service (DoS) and complete account lockout.

Original NVD description (English source)

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, improper access control allows disclosure of password hash. This issue has been patched in version 2.10.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS