CVE-2026-82266

Received Received - Intake

Redpanda Admin API Authentication Bypass

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82266

EUVD

EUVD-2026-67797

Affected Vendors & Products

Vendor	Product	Version / Range
redpanda	redpanda	to 26.2.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-82266 is a critical vulnerability in Redpanda where the Admin API binds to all network interfaces (0.0.0.0:9644) with authentication disabled by default. This allows unauthenticated attackers to perform privileged actions like creating user accounts, modifying configurations, or disrupting cluster operations.

Detection Guidance

Check if Redpanda's Admin API port 9644 is exposed to the network by running: netstat -tulnp | grep 9644 or ss -tulnp | grep 9644. Test unauthenticated access by sending a request to http://<your-server-ip>:9644/v1/status/ready. If it responds without credentials, the vulnerability is present.

Impact Analysis

An attacker could gain full control over your Redpanda cluster without credentials. This includes creating persistent admin accounts, altering data replication settings, or deleting critical configurations, leading to data loss or unauthorized access to streaming data.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict authentication for data access, while HIPAA requires safeguards against unauthorized changes to health data systems. Unauthenticated admin access risks exposing regulated data.

Mitigation Strategies

Immediately enable authentication by setting admin_api_require_auth to true in the Redpanda configuration file. Restrict the Admin API to localhost by changing the admin API listener address to 127.0.0.1:9644. Update Redpanda to the latest version where this issue is fixed.

Hi! I’m here to help you understand CVE-2026-82266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70