CLEANSTART-2026-EF54791: unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path

Q: Which deployments are exposed to this issue?

The issue affects the kafka package when it is used with EthereumAuthenticator. Deployments not using EthereumAuthenticator are not identified as affected by the available information.

Q: What must an attacker do to exploit the vulnerability?

An unauthenticated client must send a request whose path contains the configured login path. Under that condition, certain protected resources may be accessible without authentication.

Published Nov 7, 2026

Updated

Security vulnerability affects the kafka package. An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.

Affected Software

1 affected componentFixes available

cleanstart/kafka<4.1.2-r6

4.1.2-r6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.1.2-r6

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-19863

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects the kafka package when it is used with EthereumAuthenticator. Deployments not using EthereumAuthenticator are not identified as affected by the available information.

What must an attacker do to exploit the vulnerability?

An unauthenticated client must send a request whose path contains the configured login path. Under that condition, certain protected resources may be accessible without authentication.

CLEANSTART-2026-EF54791: unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the vulnerability?