EXPOSURES › CVE-2026-82266
CVE-2026-82266
CRITICALRedpanda's Admin API binds to 0.0.0.0:9644 with authentication disabled by default, allowing unauthenticated attackers to act as superusers and alter cluster configurations.
The Admin API's default configuration exposes the system to unauthenticated superuser access, enabling attackers to create/delete accounts, modify configurations, and disrupt data replication. DIB organizations must ensure strict network segmentation, enforce authentication defaults, and apply patches immediately to prevent unauthorized control of data pipelines.
Shame score — Defaulting to an unauthenticated superuser API on a publicly bindable port is a severe, avoidable negligence that directly enables cluster takeover.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.