CVE-2026-82266

CriticalCVSS 9.8/10Last modified Sep 24, 2026

Description

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-822675.4Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute an CVE-2026-822687.5Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied path CVE-2026-822698.1Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers wit CVE-2026-82278.8A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manip CVE-2026-822707.5Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator CVE-2026-822716.5R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to mod CVE-2026-822726.5Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing th CVE-2026-822736.5Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId CVE-2026-822744.7Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats t CVE-2026-822757.5Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended dire CVE-2026-822765.3StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly inste CVE-2026-822779.8Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization