Description

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T20:20:17.213Z",
  "pubdate": "2026-08-28T20:20:17.213Z",
  "executiveSummary": "Redpanda versions up to and including 26.2.2 are susceptible to a critical authentication bypass vulnerability within the Admin API.\nThe vulnerability arises from the default binding of the Admin API to 0.0.0.0:9644 combined with the default configuration of 'admin_api_require_auth' set to false.\nThis combination permits unauthenticated network entities to interface with the administrative endpoint without providing valid credentials.\nBy default, the application elevates these unauthenticated requests to superuser privileges, granting full control over the cluster.\nThe impact is severe, allowing remote, unauthenticated attackers to manipulate cluster configurations, manage broker accounts, and disrupt core partition replication processes.\nThis flaw presents a significant risk to data integrity, system availability, and cluster management security.\nExploitation requires only network connectivity to the exposed Admin API port.",
  "technicalDetails": "The vulnerability resides in the Redpanda Admin API component, specifically concerning its network binding behavior and default access control configuration.\nBy default, the Admin API is bound to 0.0.0.0:9644, exposing the interface on all network interfaces rather than restricting access to localhost or a secure management network.\nThe core security failure is that 'admin_api_require_auth' defaults to false in affected versions (up to 26.2.2).\nWhen this configuration is active, the Redpanda server does not mandate authentication tokens or credentials for incoming API requests.\nCrucially, the application logic treats any request originating from an unauthenticated source as having superuser privileges.\nThe attack flow proceeds as follows: An attacker identifies an exposed Redpanda instance reachable on port 9644. Since the service does not enforce authentication, the attacker can send arbitrary HTTP requests directly to the API endpoints.\nThe attacker can leverage these endpoints to execute high-impact administrative actions. This includes creating or deleting broker accounts, which can be used to hijack data streams or drop nodes from the cluster. Furthermore, the attacker can modify cluster-level configuration parameters, potentially disabling security features, altering replication factors, or modifying data retention policies.\nThe ability to disrupt partition replication allows an attacker to cause massive denial-of-service conditions or manipulate the consistency of the distributed logs by force-redirecting or terminating replication streams.\nNo specific exploit payload is required to bypass security; the absence of configured authentication is the exploit vector itself. Because the API treats these requests as superuser-authenticated, the full suite of administrative capabilities is exposed without authentication requirements or special privilege escalation exploits.\nThe vulnerability is inherent in the default installation state of affected Redpanda versions, necessitating explicit administrative action to secure the endpoint."
}