CVE-2026-82266: Missing Authentication for Critical Function in redpanda-data redpanda
Description
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.
CVSS v4.0
Score 9.3critical
Affected software
redpanda-data
redpanda
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82266 describes a missing authentication mechanism for the Admin API in Redpanda through version 26.2.2. The Admin API listens on 0.0.0.0:9644 with the configuration option admin_api_require_auth defaulting to false, effectively treating unauthenticated requests as superusers. This flaw enables attackers to access critical administrative functions without credentials, including broker account management and cluster configuration changes, potentially leading to service disruption.
Potential Impact
An attacker can connect to the Admin API port without authentication and gain superuser privileges. This allows unauthorized creation and deletion of broker accounts, modification of cluster configurations, and disruption of partition replication, severely impacting the availability and integrity of the Redpanda cluster.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict network access to the Admin API port (9644) to trusted hosts only and enable authentication by setting admin_api_require_auth to true if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-28T11:12:37.042Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a91e413acd9273b4942e8ce
Added to database: 08/28/2026, 19:40:03 UTC
Last enriched: 09/25/2026, 02:43:11 UTC
Last updated: 10/13/2026, 18:48:24 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.