External risk intelligence

Redpanda Admin API Unauthenticated Superuser Access Due to Default Configuration

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-82266

The vulnerability affects an Admin API that defaults to binding to all network interfaces (0.0.0.0) with authentication disabled. While administrative interfaces should typically be restricted to internal networks, the default configuration facilitates broad network exposure, making it commonly reachable in deployments where such interfaces are inadvertently exposed to the internet.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Redpanda, a technology used for managing data streams. The issue involves the Admin API, which by default, can be accessed without any authentication, allowing unauthorized users to gain superuser privileges. This could enable attackers to control broker accounts, alter cluster settings, and disrupt data replication, posing a significant risk to data integrity and availability.

Unauthenticated access grants superuser control.
Critical if administrative API is exposed externally.
Verify administrative API exposure and authentication.

Attack Path

How an attacker could exploit the issue

An attacker can reach the Redpanda Admin API on port 9644, which defaults to listening on all network interfaces without requiring authentication. This exposure allows unauthenticated access to perform administrative actions.

Network access to port 9644 required.
Unauthenticated requests trigger the vulnerability.
Unauthorized control over cluster resources.

Live Threat

Current exploitation, exposure, and threat context

When Redpanda's Admin API is exposed to the network and authentication is not enforced, unauthenticated attackers can gain administrative privileges. This could allow them to create or delete broker accounts, alter cluster configurations, and disrupt partition replication.

Broker account and cluster configuration data.
Unauthenticated network access to the Admin API.
Unauthorized administrative control and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Redpanda deployments where the Admin API is exposed and authentication is disabled by default. Infrastructure or platform teams responsible for managing Redpanda instances should prioritize identifying all deployments, assessing their exposure and criticality, and confirming the accountable owner. Remediation planning should follow this initial triage, considering factors like network reachability and business impact.

Ownership: Platform or infrastructure teams managing Redpanda.
Verify first: Identify exposed Admin API instances and their reachability.
Action: Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Redpanda?

Redpanda is a high-performance streaming data platform designed to handle real-time data feeds. It acts as a broker for event-driven applications, allowing systems to ingest, store, and process massive volumes of data streams efficiently. Because it manages critical data pipelines, its internal management interfaces—like the Admin API—are designed to oversee cluster health, configuration settings, and data replication across the entire environment.

What does CWE-306 mean for CVE-2026-82266?

CWE-306 represents a Missing Authentication for Critical Function weakness. In the context of this vulnerability, it means the software performs sensitive administrative operations—such as modifying cluster settings or managing broker accounts—without verifying the identity of the person making the request. Because the Admin API does not enforce authentication by default, it effectively trusts any incoming connection as a superuser, bypassing necessary security controls.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending network requests to the Redpanda Admin API on port 9644. The vulnerability occurs when the service is configured with default settings that lack authentication. Crucially, simply having the port open is the core issue; requests made from a restricted local environment where the API is not reachable over a wider network do not expose the service to external unauthorized access.

Is my Redpanda deployment at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your Admin API is bound to all network interfaces (0.0.0.0) instead of being restricted to internal, private management networks. While administrative interfaces should be isolated, the default configuration can make them reachable over broader network segments. If your instance is exposed to the public internet or untrusted segments, the risk of unauthorized administrative access is significantly higher.

What should I do if I run Redpanda?

Start by identifying all instances of Redpanda within your environment. Focus on checking the configuration of the Admin API on port 9644 to confirm if authentication is enabled and to see if the service is unintentionally accessible across your network. Once you have a clear map of your exposed instances, prioritize securing those that are most critical or reachable from untrusted zones, and plan for updates or configuration changes to enforce proper access control.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.