CVE-2026-5562
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In provectus kafka-ui up to version 0.7.2, the function validateAccess in /api/smartfilters/testexecutions is vulnerable to code injection. The attack can be initiated remotely, and the exploit is publicly available. The vendor did not respond.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, leading to full compromise of the system and data.
Recommendation
Immediately disable or replace kafka-ui with a more secure solution, as the vendor has not released patches.
Other vulnerabilities in kafka-ui
See all- CVE-2024-32030High
Kafka UI, an open-source web UI for Apache Kafka management, allows users to connect to different Kafka brokers and monitor their performance via JMX ports. JMX is based on the RMI protocol, which is inherently susceptible to deserialization attacks. An attacker can exploit this feature by connecting the Kafka UI backend to a malicious broker, potentially leading to remote code execution (RCE). The vulnerability affects deployments where dynamic.config.enabled is set or where an attacker has access to the Kafka cluster connected to Kafka UI.
- CVE-2025-60537Medium
Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data. The flaw results from insufficient validation of input before processing.
Original NVD description (English source)
A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS