Executive brief
Kafka-ui is an open-source web interface for managing Apache Kafka clusters. An authenticated user can bypass the Groovy script execution security control (filtering.groovy.enabled=false) via the smart filter test endpoint and execute arbitrary commands on the server, potentially accessing Kafka credentials and pivoting to internal systems.
Technical details
The vulnerability is a code injection flaw in the executeSmartFilterTest method of MessagesController.java. While the getTopicMessages endpoint checks the filtering.groovy.enabled security flag before executing Groovy scripts, the smart filter test endpoint does not perform this check. An authenticated attacker can send a PUT request to /api/smartfilters/testexecutions with malicious Groovy code in the filterCode parameter, which is directly passed to GroovyScriptEngineImpl for compilation and execution. The vulnerability requires authentication but no elevated privileges. The attacker can achieve remote code execution, read files on the server filesystem, and potentially pivot to connected Kafka brokers and related services. No fix has been released as of the advisory date; the vendor was notified early but had not responded.
Affected products
- Provectus kafka-ui up to 0.7.2
Timeline
- 2026-07-01: disclosed: Issue reported on GitHub (geo-chen)
- 2026-08-24: advisory: CVE-2026-78166 published