Redpanda Admin API Vulnerability Exposing Authentication Flaw

CVE-2026-82266

What is CVE-2026-82266?

The Redpanda Admin API is susceptible to an authentication bypass vulnerability due to its configuration, which binds the API to all network interfaces (0.0.0.0:9644) and defaults admin_api_require_auth to false. This misconfiguration allows unauthenticated users to access the Admin API, potentially executing privileged commands. Attackers can create and delete broker accounts, alter cluster configurations, and disrupt partition replication, posing a significant threat to the integrity and availability of the system. It is crucial for users to ensure proper configuration and restrict access to the Admin API to safeguard against these unauthorized actions.

References