CVE-2026-82266

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82266
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82266.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82266
Published
2026-08-28T16:18:50Z
Modified
2026-09-03T03:30:28Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Details

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82266.json"
}
References

Affected packages

Git / github.com/redpanda-data/redpanda

Affected ranges

Type
GIT
Repo
https://github.com/redpanda-data/redpanda
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fd30e45b31e0c5e9595e530121a0896e3ddd12a3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "26.2.2"
        },
        {
            "fixed": "26.2.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

operator/v2.*
operator/v2.0.0
release-0.*
release-0.99.24
release-20.*
release-20.11.1
release-20.11.2
release-20.11.3
release-20.11.4
release-20.11.5
release-20.11.6
release-20.12.1
release-20.12.2
release-20.12.3
release-20.12.4
release-20.12.5
src/transform-sdk/go/transform/v0.*
src/transform-sdk/go/transform/v0.1.0
src/transform-sdk/go/transform/v0.2.0
src/transform-sdk/go/transform/v1.*
src/transform-sdk/go/transform/v1.0.0
src/transform-sdk/go/transform/v1.0.1
src/transform-sdk/go/transform/v1.0.2
src/transform-sdk/go/transform/v1.1.0
transform-sdk/v0.*
transform-sdk/v0.1.0
transform-sdk/v0.2.0
transform-sdk/v1.*
transform-sdk/v1.0.0
transform-sdk/v1.0.1
transform-sdk/v1.0.2
transform-sdk/v1.1.0
v20.*
v20.12.5
v20.12.6
v20.12.7
v20.12.9
v21.*
v21.1.1
v21.1.2
v21.1.3
v21.1.4
v21.1.5
v21.10.1-beta1
v21.10.1-beta2
v21.11.1-beta1
v21.12.1-wasm-beta1
v21.2.1
v21.2.2
v21.3.1
v21.3.2
v21.3.3
v21.3.4
v21.3.4-beta1
v21.3.5
v21.3.5-beta1
v21.3.5-beta2
v21.3.5-beta3
v21.3.5-beta4
v21.3.5-beta5
v21.3.5-beta6
v21.3.6
v21.3.6-beta1
v21.3.7
v21.4.1
v21.4.10
v21.4.11
v21.4.12
v21.4.13
v21.4.14
v21.4.15
v21.4.16-beta1
v21.4.2
v21.4.3
v21.4.4
v21.4.5
v21.4.6
v21.4.7
v21.4.8
v21.4.9
v21.5.1
v21.5.2
v21.5.2-beta1
v21.5.2-beta2
v21.5.2-beta3
v21.5.3
v21.5.4
v21.5.5
v21.5.6
v21.5.6-beta1
v21.5.7
v21.6.1
v21.6.2
v21.6.3
v21.6.4
v21.6.5
v21.6.6
v21.7.1
v21.7.2
v21.7.3
v21.7.5
v21.7.6
v21.8.1-beta1
v21.8.1-beta2
v21.9.1-beta1
v22.*
v22.1.1-rc1
v22.2.1-rc1
v22.2.1-rc2
v22.2.1-rc3
v22.3.0-dev
v22.3.1-rc1
v22.3.1-rc2
v22.3.1-rc3
v22.3.1-rc4
v22.3.1-rc5
v23.*
v23.1.0-dev
v23.1.1-rc1
v23.1.1-rc2
v23.1.1-rc3
v23.1.1-rc4
v23.1.1-rc5
v23.1.1-rc6
v23.1.1-rc7
v23.2.0-dev
v23.2.1-rc1
v23.2.1-rc2
v23.2.1-rc3
v23.2.1-rc4
v23.2.1-rc5
v23.2.1-rc6
v23.2.1-rc7
v23.3.0-dev
v23.3.1-rc1
v23.3.1-rc2
v23.3.1-rc3
v23.3.1-rc4
v24.*
v24.1.1-rc1
v24.1.1-rc2
v24.1.1-rc3
v24.1.1-rc4
v24.1.1-rc5
v24.1.1-rc6
v24.2.1-rc1
v24.2.1-rc2
v24.2.1-rc3
v24.2.1-rc4
v24.2.1-rc5
v24.3.1-rc1
v24.3.1-rc2
v24.3.1-rc3
v24.3.1-rc4
v24.3.1-rc5
v25.*
v25.1.0-dev
v25.1.1-rc1
v25.1.1-rc2
v25.2.0-dev
v25.2.1-rc1
v25.2.1-rc2
v25.2.1-rc3
v25.3.0-dev
v25.3.1-rc1
v25.3.1-rc2
v25.3.1-rc3
v26.*
v26.1.1
v26.1.1-rc1
v26.1.1-rc2
v26.1.1-rc3
v26.1.1-rc4
v26.1.1-rc5
v26.2.1
v26.2.1-rc1
v26.2.1-rc2
v26.2.1-rc3
v26.2.1-rc4
v26.2.1-rc5
v26.2.1-rc6
v26.2.2-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82266.json"