Redpanda through version 26.2.2 exposes its Admin API on all interfaces with authentication disabled by default, letting any attacker who can reach port 9644 operate as a cluster superuser.
What Is It
Redpanda binds the Admin API to 0.0.0.0:9644 while admin_api_require_auth defaults to false. In that configuration the service treats unauthenticated requests as superusers; no credentials are checked before privileged operations are executed. The flaw is classified as CWE-306 (Missing Authentication for Critical Function) and was disclosed by VulnCheck.
Because the bind address is wildcard by default, the API is reachable from any network the host is attached to unless an operator has explicitly restricted it.
Why It Matters
CVSS v3.1 rates this 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the CVSS v4.0 score is 9.3 (CRITICAL). Attack vector is network, attack complexity is low, and neither privileges nor user interaction are required.
Per the advisory, an attacker reaching port 9644 without credentials can:
- Create and delete broker accounts
- Modify cluster configuration
- Disrupt partition replication
That covers full confidentiality, integrity, and availability impact on the affected cluster; account takeover, silent config tampering, and denial of service against data replication.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no federal remediation deadline at this time.
What's Vulnerable
- Vendor: redpanda-data
- Product: Redpanda
- Affected versions: all versions from 0 through 26.2.2 (semver, inclusive)
- Default status for other versions: unaffected
Exposure depends on default configuration, so deployments that have already set admin_api_require_auth to true or restricted the bind address for port 9644 are not in the default vulnerable state.
Patch Status
The supplied data does not name a fixed release or vendor patch. The record was published 2026-08-28 with a status of "Received," meaning NVD analysis is not yet complete. No required action or remediation deadline is specified in the supplied material. Operators should consult the vendor references below for current guidance.
Sources
- NVD, CVE-2026-82266: https://nvd.nist.gov/vuln/detail/CVE-2026-82266
- VulnCheck Advisory; Redpanda Admin API Unauthenticated Superuser Access via Default Configuration: https://www.vulncheck.com/advisories/redpanda-admin-api-unauthenticated-superuser-access-via-default-configuration
- Redpanda GitHub Repository: https://github.com/redpanda-data/redpanda
- Redpanda default config (
conf/redpanda.yaml): https://github.com/redpanda-data/redpanda/blob/3cfce474a872090e7c74d14181885f5838c54cf2/conf/redpanda.yaml - Redpanda auth handling (
src/v/security/request_auth.cc): https://github.com/redpanda-data/redpanda/blob/3cfce474a872090e7c74d14181885f5838c54cf2/src/v/security/request_auth.cc - Redpanda Issue #30989: https://github.com/redpanda-data/redpanda/issues/30989