CVE-2026-82266
CriticalCVSS 9.8Summary
Redpanda through version 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.
Risk Assessment
The risk includes unauthorized administrative access to the cluster, potentially leading to data integrity compromise and system disruption.
Recommendation
It is recommended to enable authentication requirement for the Admin API and restrict network access to port 9644.
Original NVD description (English source)
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.