Unauthenticated Remote Code Execution in Redpanda Connect

CVE-2026-123270

What is CVE-2026-123270?

Redpanda Connect versions 4.39 to 4.110 are susceptible to a vulnerability that allows unauthenticated remote code execution due to disabled authentication on the management HTTP API. The affected API, reachable on TCP/4195, lacks protection on its stream CRUD routes, enabling an attacker with network access to execute arbitrary commands. This severe security flaw can lead to full host compromise, including credential theft and data exfiltration, without requiring user interaction or valid credentials. Subsequent versions, starting from v4.111, reconfigured the API endpoint to be opt-in, though RCE remains a risk if the management API is manually enabled.

References