Unsafe Deserialization Vulnerability in Kafbat UI for Apache Kafka Clusters
CVE-2025-49127

8.9HIGH

Key Information:

Vendor

Kafbat

Status
Kafka-ui
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49127?

CVE-2025-49127 is an unsafe deserialization vulnerability found in Kafbat UI, a web-based user interface for managing Apache Kafka clusters. This vulnerability affects version 1.0.0 of Kafbat UI, allowing any unauthenticated user to execute arbitrary code on the server hosting the application. The risk associated with this vulnerability is substantial, as an attacker can exploit it to gain unauthorized control over the server, potentially compromising confidential data, manipulating Kafka clusters, and affecting overall system integrity. Kafbat UI serves a crucial function in handling data streaming applications powered by Apache Kafka, making its security paramount for organizations that rely on this technology.

Potential impact of CVE-2025-49127

  1. Unauthorized Remote Code Execution: The most critical impact of CVE-2025-49127 is the potential for remote code execution by unauthenticated users. This ability allows attackers to execute arbitrary commands on the server, which can lead to significant breaches of security and system functionality.

  2. Data Compromise and Manipulation: With the capability to execute code on the server, attackers can access sensitive data processed or stored within the Kafka clusters. This could lead to data leakage, corruption, or unauthorized modifications, affecting the reliability and confidentiality of data-driven applications.

  3. Operational Disruption: Exploitation of this vulnerability could result in operational disruptions for organizations that rely on Kafbat UI and Apache Kafka. An attacker may manipulate the functioning of Kafka clusters, leading to downtime or degraded performance of applications that depend on this system, ultimately impacting business operations and user satisfaction.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

kafka-ui = 1.0.0

References

https://github.com/kafbat/kafka-ui/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/kafbat/kafka-ui/releases/tag/v1.1.0
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.