CVE-2026-82266: Unauthenticated Redpanda Admin API Access

Redpanda versions 26.2.2 and earlier contain a critical configuration vulnerability where the Admin API is bound to 0.0.0.0:9644 by default, and the admin_api_require_auth setting defaults to false. This configuration treats all incoming requests as having superuser privileges. An unauthenticated attacker with network access to the management port can perform sensitive operations, including the creation or deletion of broker accounts, modification of cluster-wide configurations, and the disruption of partition replication. This effectively grants an attacker full administrative control over the Redpanda cluster. Because this is a default behavior in older versions, any cluster exposed to the internet or an untrusted network segment without additional firewall controls is at risk of complete compromise.

Impact

Successful exploitation grants an attacker full administrative access to the Redpanda cluster. Observed impacts include unauthorized manipulation of cluster state, credential theft or modification of service accounts, and catastrophic data disruption through partition manipulation or service shutdown. This vulnerability poses a severe risk to data integrity and availability in any environment where the management API is reachable from outside a strictly controlled local segment.

Recommendation

Prioritized actions for security teams:

• Immediately restrict network access to port 9644 to only known, trusted administrative IP addresses using host-based firewalls or network security groups.
• Upgrade all Redpanda deployments to a version greater than 26.2.2 where the default configuration requires authentication.
• Review cluster configuration files to verify that admin_api_require_auth is explicitly set to true.
• Audit logs for the Admin API to identify any unauthorized requests originating from unexpected IP addresses.