CVE-2026-25999 is an improper authorization vulnerability (CWE-285) found in Aiven-Open's Klaw, a self-service Apache Kafka topic management and governance portal. The flaw exists in versions prior to 2.10.2, where the /resetMemoryCache endpoint lacks proper access controls. This endpoint is designed to reset or clear cached metadata related to tenant configurations, environments, and Kafka cluster data. An attacker with limited privileges (PR:L - privileges required) can send a crafted HTTP request to this endpoint without user interaction (UI:N) and trigger a reset or deletion of critical metadata. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity, with network attack vector (AV:N), low attack complexity (AC:L), and no confidentiality impact but partial integrity loss and high availability impact (I:L, A:H). Exploitation can cause disruption of Kafka topic management services by clearing cached data, potentially leading to misconfigurations, downtime, or operational delays. The vulnerability is fixed in Klaw version 2.10.2. No public exploits are currently known, but the ease of exploitation and impact on availability make this a significant risk for organizations relying on Klaw for Kafka governance.

For European organizations, the vulnerability poses a significant risk to the availability and integrity of Kafka topic management services. Kafka is widely used in critical sectors such as finance, telecommunications, and cloud infrastructure across Europe. Exploitation could lead to unexpected resets of cached configurations, causing service disruptions, delays in topic governance, and potential operational outages. This could impact business continuity, especially for organizations with real-time data processing needs. The integrity of metadata is compromised, which may lead to misconfigurations or loss of audit trails. Although confidentiality is not directly affected, the operational impact can indirectly affect compliance with regulations like GDPR if service disruptions affect data processing. Organizations using Klaw in multi-tenant environments are particularly vulnerable, as attackers can target any tenant's metadata. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, especially given the low complexity of exploitation.

Organizations should immediately upgrade Klaw to version 2.10.2 or later to apply the official fix. Until the patch is applied, restrict network access to the /resetMemoryCache endpoint using firewalls or API gateways to limit exposure to trusted users only. Implement strong authentication and authorization controls around management interfaces, ensuring that only authorized administrators can access sensitive endpoints. Monitor logs and network traffic for unusual or unauthorized requests to the reset endpoint. Employ anomaly detection to identify potential exploitation attempts. Conduct regular audits of Kafka governance configurations and metadata integrity to detect any unauthorized changes. For multi-tenant deployments, enforce tenant isolation and review access policies to minimize the risk of cross-tenant attacks. Finally, integrate vulnerability scanning and patch management processes to promptly identify and remediate similar issues in the future.