Executive brief
KnowStreaming is an open-source Kafka management platform used to simplify enterprise Kafka operations. A flawed authorization mechanism allows any authenticated user to call administrative API endpoints without proper permission checks, enabling attackers to create admin accounts or escalate their privileges to administrators—effectively taking control of the Kafka platform.
Technical details
KnowStreaming through version 3.4.1 fails to properly enforce role-based access control (RBAC) on REST API endpoints. The vulnerability is rooted in insufficient authorization checks in the PermissionInterceptor component, allowing authenticated users to bypass role validation. Attackers with any valid user account can call identity-management endpoints to create new administrator accounts or grant themselves administrative privileges. The attack requires authentication (existing valid user credentials) but no other preconditions; an attacker can exploit this via network requests to protected REST endpoints. Patches addressing RBAC enforcement are expected to be available in versions after 3.4.1.
Affected products
- Didi KnowStreaming through 3.4.1
Timeline
- 2026-09-16: disclosed