CVE-2026-82266

CRITICAL 9.8

Redpanda Admin API Unauthenticated Superuser Access via Default Configuration

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

CWE	CWE-306
Vendor	redpanda-data
Product	redpanda
Published	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for redpanda-data redpanda

Be the first to know when new critical vulnerabilities affecting redpanda-data redpanda are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

redpanda-data / redpanda

0 ≤ 26.2.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/redpanda-data/redpanda/issues/30989 github.com: https://github.com/redpanda-data/redpanda github.com: https://github.com/redpanda-data/redpanda/blob/3cfce474a872090e7c74d14181885f5838c54cf2/conf/redpanda.yaml github.com: https://github.com/redpanda-data/redpanda/blob/3cfce474a872090e7c74d14181885f5838c54cf2/src/v/security/request_auth.cc vulncheck.com: https://www.vulncheck.com/advisories/redpanda-admin-api-unauthenticated-superuser-access-via-default-configuration

Credits

🔍 George Chen