CVE-2026-5562

provectus kafka-ui Endpoint testexecutions validateAccess code injection

No known exploitation. EPSS puts it in the 88th percentile. No fix published yet.

CVSS 3.17.3High EPSS percentile88th3.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-04-05Updated 2026-07-24Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run kafka-ui up to version 0.7.2 and whether its web interface is reachable from outside your trusted network.
There is currently no vendor-fixed version available; contact your software supplier or the vendor for a supported update timeline.
Until a fix is available, restrict access to kafka-ui to administrators on your private network or through your secure remote-access service.
Review access records for unusual requests to /api/smartfilters/testexecutions and investigate unexpected changes in kafka-ui.

May need vendor or contractor work

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

In plain language

Written by AI from the record

kafka-ui versions up to 0.7.2 have a remotely reachable code-injection flaw; small businesses using it should limit access and seek a vendor fix.

Unauthenticated remote code injection in kafka-ui’s `/api/smartfilters/testexecutions` endpoint through the `validateAccess` function.

If you're affected

Kafka UI data exposure
Unauthorized UI changes
Kafka operations disruption

What is it

This flaw may let an outsider send specially crafted information to kafka-ui that is treated as instructions instead of ordinary data. It is like a visitor finding a way to slip their own commands into a staff-only control panel.

Who is affected

This matters to you if you use or run kafka-ui, especially to view or manage Kafka systems. It is a risk only when the affected service can be reached remotely.

How urgent is it

Attackers can attempt this remotely, so reduce exposure promptly. It is not listed in CISA’s known-exploited vulnerability catalog, and the available exploitation evidence is limited to a detection template, which supports an amber priority rather than an emergency response.

What to do — in detail

Confirm the deployed kafka-ui version and identify every internet-facing or externally reachable instance. Versions up to 0.7.2 are affected; no fixed release or supported branch target has been published, so do not assume that a newer version is safe without vendor confirmation.

If an update becomes available, test it in a non-production environment first, review its release notes for configuration or compatibility changes, then upgrade all instances. Until then, place kafka-ui behind private-network access, an authenticated gateway, or firewall rules that allow only required administrator networks; restrict access to /api/smartfilters/testexecutions where your proxy or gateway supports that safely.

No CISA KEV remediation due date applies. Monitor web and gateway logs for requests to /api/smartfilters/testexecutions, unexpected kafka-ui errors, and unapproved configuration or access changes.

Technical context

CVE-2026-5562 is rated CVSS 7.3 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It is a remote, low-complexity code-injection issue associated with CWE-74 and CWE-94 in the validateAccess function for /api/smartfilters/testexecutions. CISA KEV does not list it. EPSS predicts a 2.0% likelihood (80th percentile) with a flat trend; this is predictive only. Available exploit maturity evidence is limited to a detection template, while press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS88th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

3.4% chance of exploitation activity in the next 30 days, which ranks it in the 88th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 162 days, from the signal feeds we watch.

2026-09-14Nuclei check added
2026-07-24Record updated
2026-04-30Record updated
2026-04-05Publishedweakness classified, att&ck mapped

Affected products

provectuscommercialaka kafka-ui, ui
- uiMixedEnterprise Software / itsm-monitoring
- kafka-uiMixedEnterprise Software / itsm-monitoring

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Scored 7.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service