PT-2026-7718 · Klaw+1 · Klaw+1

Audrey Budryte · Publicado 2026-02-11 · Atualizado 2026-02-11 · CVE-2026-25999

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Klaw versions prior to 2.10.2

Description Klaw, a self-service Apache Kafka Topic Management/Governance tool/portal, contains an improper access control issue. This allows unauthorized users to trigger a reset or deletion of metadata for any tenant. An attacker can send a crafted request to the /resetMemoryCache API endpoint to clear cached configurations, environments, and cluster data. The resetMemoryCache function is vulnerable to this manipulation.

Recommendations Update to version 2.10.2 or later.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2026-25999

GHSA-RP26-QV9W-XR5Q

Produtos afetados

Apache Kafka

Klaw

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25999.json · Exploit
• https://github.com/Aiven-Open/klaw/security/advisories/GHSA-rp26-qv9w-xr5q · Aviso do Fabricante
• https://github.com/Aiven-Open/klaw/commit/617ed96b1db111ed498d89132321bf39f486e3a1 · Correção
• https://github.com/Aiven-Open/klaw/releases/tag/v2.10.2 · Nota
• https://osv.dev/vulnerability/CVE-2026-25999 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25999 · Nota de Segurança
• https://twitter.com/CVEnew/status/2021698419362816136 · Publicação no Twitter