PT-2025-24331 · Apache+1 · Apache Kafka+1

Trganda · Published 2025-01-13 · Updated 2025-08-20 · CVE-2025-49127

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kafbat UI version 1.0.0 Kafbat UI versions prior to 1.1.0

Description Kafbat UI is a web user interface designed for managing Apache Kafka clusters. An unsafe deserialization vulnerability exists that allows any unauthenticated user to execute arbitrary code on the server. The issue stems from the application’s dynamic cluster configuration functionality that accepts user-provided JMX endpoints without proper validation.

Recommendations Kafbat UI version 1.0.0: Upgrade to version 1.1.0 or later to resolve this issue. Kafbat UI versions prior to 1.1.0: Upgrade to version 1.1.0 or later to resolve this issue.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-14363

CVE-2025-49127

GHSA-G3MF-C374-FGH2

Affected Products

Apache Kafka

Kafbat Ui

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49127.json · Exploit
• 🔥 https://github.com/kafbat/kafka-ui/security/advisories/GHSA-g3mf-c374-fgh2 · Exploit
• https://osv.dev/vulnerability/CVE-2025-49127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49127 · Security Note
• https://bdu.fstec.ru/vul/2025-14363 · Security Note
• https://github.com/kafbat/kafka-ui/releases/tag/v1.1.0 · Note
• https://twitter.com/autumn_good_35/status/1944733184421425225 · Twitter Post
• https://twitter.com/Valko_CybrWolf/status/1931406183585501383 · Twitter Post
• https://twitter.com/offseq/status/1931252328318799997 · Twitter Post
• https://t.me/cvetracker/25680 · Telegram Post
• https://twitter.com/hackyboiz/status/1958106738911281249 · Twitter Post
• https://t.me/cybersecuritytechnologies/12176 · Telegram Post
• https://t.me/cvenotify/124977 · Telegram Post
• https://twitter.com/CVEnew/status/1931127825903546712 · Twitter Post
• https://t.me/purp_sec/911 · Telegram Post