CVE-2026-123270
Received Received - Intake

Unauthenticated RCE in Redpanda Connect

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: CERT/CC

Description
Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. Starting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123270
EUVD
EUVD-2026-120155

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Redpanda Data Connect From 4.39 (inc) to 4.110 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123270 is an unauthenticated remote code execution (RCE) vulnerability in Redpanda Connect versions 4.39 to 4.110 when running in streams mode. The management HTTP API, exposed on port 4195 by default, lacks authentication. An attacker can send an unauthenticated POST request to create a stream with a malicious pipeline containing code-executing processors like command or subprocess. This allows arbitrary command execution on the host system with the privileges of the Redpanda Connect service account.

Detection Guidance
  • Check if Redpanda Connect is running in streams mode with the management API exposed on port 4195 by running: netstat -tulnp | grep 4195 or ss -tulnp | grep 4195.
  • Verify the version of Redpanda Connect installed. If it is between 4.39 and 4.110, the system is vulnerable by default.
  • Check for unauthenticated access to the management API by attempting to send a GET request to http://<target-ip>:4195/streams without credentials.
Impact Analysis

This vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. Attackers can execute arbitrary commands, access sensitive data, and escalate privileges on the affected system.

Mitigation Strategies
  • Upgrade Redpanda Connect to version 4.111 or later where the management API is opt-in by default.
  • If upgrading is not possible, disable the management API by ensuring the --bind-http flag is not used.
  • Restrict network access to port 4195 using firewall rules to prevent unauthenticated access from untrusted networks.
  • Monitor network traffic for suspicious POST requests to /streams/{id} endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...