CVE-2026-82266

Redpanda versions through 26.2.2 ship with the Admin API bound to all interfaces on port 9644 while the admin_api_require_auth setting defaults to false, so unauthenticated requests are treated as superusers (missing authentication, CWE-306). Any client that can reach port 9644 on a broker over the network can issue administrative requests with no credentials. An attacker can thereby create and delete broker accounts, alter cluster configuration, and disrupt partition replication, effectively gaining full administrative control of the cluster's admin plane; CVSS 4.0 rates this 9.3 critical with high confidentiality, integrity, and availability impact on the vulnerable system. All Redpanda deployments at or before version 26.2.2 are affected, especially clusters whose port 9644 is reachable from untrusted networks such as the internet or shared networks. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is reported, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade affected clusters to a fixed release beyond 26.2.2 when available, and in the meantime set admin_api_require_auth to true so unauthenticated requests no longer receive superuser privileges. Restrict port 9644 with firewall rules so only trusted hosts can reach the Admin API, or bind it to a private or loopback interface. Audit clusters whose port 9644 was reachable from untrusted networks for unexplained broker account or configuration changes.