Executive brief
Redpanda is a Kafka-compatible data streaming platform. A critical vulnerability in versions through 26.2.2 leaves the Admin API accessible without authentication by default, binding to all network interfaces (0.0.0.0:9644). An attacker with network access can create or delete broker accounts, modify cluster configuration, and disrupt data replication without any credentials.
Technical details
The Admin API in Redpanda is bound to 0.0.0.0:9644 with the admin_api_require_auth setting defaulting to false, causing unauthenticated requests to be treated as superuser operations. The vulnerability is an authentication bypass / insecure default configuration that allows network-accessible remote attackers to perform privileged administrative actions including broker account management, cluster configuration changes, and partition replication disruption. No authentication or user interaction is required; the attack vector is network-based and exploitable immediately upon deployment with default settings.
Affected products
- Redpanda Redpanda through 26.2.2
Timeline
- 2026-08-28: disclosed