CVE-2026-5562

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-94

Affected software

Vendor	Product	Versions
provectus	kafka-ui	0.7.0; 0.7.1; 0.7.2

References

https://drive.google.com/file/d/18-Q4tb19y_7dwchnTCgcwfbox0Uj6oQd/viewExploit, Third Party Advisory
https://vuldb.com/submit/782941Third Party Advisory, VDB Entry
https://vuldb.com/vuln/355332Third Party Advisory, VDB Entry
https://vuldb.com/vuln/355332/ctiPermissions Required, VDB Entry

Timeline

Published: Apr 5, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-556207.5eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-556217.7Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copyin CVE-2026-556227.7Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying whe CVE-2026-556245.3MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take ite CVE-2026-556254.9GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material CVE-2026-556267.3xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend ov CVE-2026-556285.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concat CVE-2026-556298.7Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by re CVE-2026-55636.3A security flaw has been discovered in AutohomeCorp frostmourne up to 1.0. Affected is the function httpTest of the file /api/monitor-api/al CVE-2026-556300.0Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user inp CVE-2026-556317.2DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to CVE-2026-556324.3GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pip