CVE-2026-25999: Klaw has an improper authorisation check on /resetMemoryCache

Q: What is the severity of CVE-2026-25999?

CVE-2026-25999 is considered a critical vulnerability due to its potential to allow unauthorized access to sensitive metadata.

Q: How do I fix CVE-2026-25999?

To fix CVE-2026-25999, upgrade Klaw to version 2.10.2 or later.

Q: What kind of attack can exploit CVE-2026-25999?

CVE-2026-25999 can be exploited by unauthorized users to reset or delete metadata for any tenant in the system.

Q: Who is affected by CVE-2026-25999?

CVE-2026-25999 affects users of Klaw versions prior to 2.10.2.

Q: What functionality is compromised by CVE-2026-25999?

CVE-2026-25999 compromises the access control functionality related to the /resetMemoryCache endpoint.

Published Feb 11, 2026

Updated

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.

Affected Software

2 affected components

Klaw<2.10.2

aiven Klaw<2.10.2

Remediation

Patch Available

https://github.com/Aiven-Open/klaw/commit/617ed96b1db111ed498d89132321bf39f486e3a1

Event History

Feb 11, 2026

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 18, 58128

Event

via FIRST·09:50 AM

Frequently Asked Questions

What is the severity of CVE-2026-25999?

CVE-2026-25999 is considered a critical vulnerability due to its potential to allow unauthorized access to sensitive metadata.

How do I fix CVE-2026-25999?