CVE-2026-5562

provectus kafka-ui Endpoint testexecutions validateAccess code injection

Published: Apr 5, 2026Updated: Jul 24, 2026 Sources: CVE List NVDCWE-74

7.3HIGH

Description

A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

In plain language

AI Worth attention

kafka-ui versions up to 0.7.2 have a remotely reachable code-injection flaw; small businesses using it should limit access and seek a vendor fix.

Executive summary

Unauthenticated remote code injection in kafka-ui’s `/api/smartfilters/testexecutions` endpoint through the `validateAccess` function.

If affected, business impact

Kafka UI data exposureUnauthorized UI changesKafka operations disruption

What to do now

Check whether you run kafka-ui up to version 0.7.2 and whether its web interface is reachable from outside your trusted network.
There is currently no vendor-fixed version available; contact your software supplier or the vendor for a supported update timeline.
Until a fix is available, restrict access to kafka-ui to administrators on your private network or through your secure remote-access service.
Review access records for unusual requests to /api/smartfilters/testexecutions and investigate unexpected changes in kafka-ui.

May need vendor / contractor work

What is it

This flaw may let an outsider send specially crafted information to kafka-ui that is treated as instructions instead of ordinary data. It is like a visitor finding a way to slip their own commands into a staff-only control panel.

Who is affected

This matters to you if you use or run kafka-ui, especially to view or manage Kafka systems. It is a risk only when the affected service can be reached remotely.

How urgent is it

Attackers can attempt this remotely, so reduce exposure promptly. It is not listed in CISA’s known-exploited vulnerability catalog, and the available exploitation evidence is limited to a detection template, which supports an amber priority rather than an emergency response.

What to do — in detail

Confirm the deployed kafka-ui version and identify every internet-facing or externally reachable instance. Versions up to 0.7.2 are affected; no fixed release or supported branch target has been published, so do not assume that a newer version is safe without vendor confirmation.

If an update becomes available, test it in a non-production environment first, review its release notes for configuration or compatibility changes, then upgrade all instances. Until then, place kafka-ui behind private-network access, an authenticated gateway, or firewall rules that allow only required administrator networks; restrict access to /api/smartfilters/testexecutions where your proxy or gateway supports that safely.

No CISA KEV remediation due date applies. Monitor web and gateway logs for requests to /api/smartfilters/testexecutions, unexpected kafka-ui errors, and unapproved configuration or access changes.

Technical context

CVE-2026-5562 is rated CVSS 7.3 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It is a remote, low-complexity code-injection issue associated with CWE-74 and CWE-94 in the validateAccess function for /api/smartfilters/testexecutions. CISA KEV does not list it. EPSS predicts a 2.0% likelihood (80th percentile) with a flat trend; this is predictive only. Available exploit maturity evidence is limited to a detection template, while press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:LConfidentiality

Low

I:LIntegrity

Low

A:LAvailability

Low

Open in CVSS calculator →

Weaknesses

CWE-74 CWE-94

Affected Products

provectus

commercialaka ui, kafka-ui

uiMixed

Enterprise Software / itsm-monitoring

kafka-uiMixed

Enterprise Software / itsm-monitoring

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-5562?Discuss checks for your systems with a specialist. Scope agreed before testing. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Execution

Initial Access

View detailed technique mapping

References

https://drive.google.com/file/d/18-Q4tb19y_7dwchnTCgcwfbox0Uj6oQd/view

drive.google.com

https://vuldb.com/submit/782941

vuldb.com

https://vuldb.com/vuln/355332

vuldb.com

and 1 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-5562 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows