CVE-2026-82266: Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set admin_api_require_auth to true so unauthenticated requests are not treated as superusers (Redpanda 26.2.2 defaults to false and binds the Admin API to 0.0.0.0:9644).
Redpanda Admin API admin_api_require_auth = true - Configuration
Restrict the Admin API listener currently bound to 0.0.0.0:9644 to a trusted interface/IP so attackers cannot reach port 9644 without credentials.
Redpanda Admin API bind address for Admin API (port 9644) = localhost / trusted interface
Event History
Frequently Asked Questions
Which deployments are exposed?
Redpanda deployments through 26.2.2 are exposed when the Admin API is reachable on port 9644. The default configuration binds that API to 0.0.0.0:9644 and does not require authentication.
What does an attacker need to exploit this issue?
An attacker needs only network reachability to port 9644; no credentials or user interaction are required. Unauthenticated Admin API requests are treated as superuser requests.
What can an unauthenticated attacker do?
An attacker can create or delete broker accounts, modify cluster configuration, and disrupt partition replication. This can affect confidentiality, integrity, and availability.
What configuration should be changed if patching is not immediately possible?
Require authentication for the Admin API by enabling admin_api_require_auth. Restrict network access to port 9644 so untrusted hosts cannot reach the Admin API.