CVE-2026-78166

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-78166

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78166.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-78166

Published

2026-08-24T01:00:11.519Z

Modified

2026-08-28T11:30:48.428402540Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection

Details

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78166.json",
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/provectus/kafka-ui

Affected ranges

Type

GIT

Repo

https://github.com/provectus/kafka-ui

Events

Introduced

fdd9ad94c11d44259ef26bf4b2dc9a8bd139f607

Last affected

83b5a60cc08501b570a0c4d0b4cdfceb1b88d6b7

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.7.0"
        },
        {
            "last_affected": "0.7.0"
        },
        {
            "introduced": "0.7.1"
        },
        {
            "last_affected": "0.7.1"
        },
        {
            "introduced": "0.7.2"
        },
        {
            "last_affected": "0.7.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.7.0

0.7.1

0.7.2

charts/kafka-ui-0.*

charts/kafka-ui-0.7.0

charts/kafka-ui-0.7.1

v0.*

v0.7.0

v0.7.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78166.json"