PT-2026-7718 · Klaw+1 · Klaw+1

Audrey Budryte · Published 2026-02-11 · Updated 2026-02-11 · CVE-2026-25999

Positive Technologies · (AI Summary)

CVSS v3.1

7.1

High

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Klaw versions prior to 2.10.2

Description Klaw, a self-service Apache Kafka Topic Management/Governance tool/portal, contains an improper access control issue. This allows unauthorized users to trigger a reset or deletion of metadata for any tenant. An attacker can send a crafted request to the /resetMemoryCache API endpoint to clear cached configurations, environments, and cluster data. The resetMemoryCache function is vulnerable to this manipulation.

Recommendations Update to version 2.10.2 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-25999

GHSA-RP26-QV9W-XR5Q

Affected Products

Apache Kafka

Klaw

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25999.json · Exploit
• https://github.com/Aiven-Open/klaw/security/advisories/GHSA-rp26-qv9w-xr5q · Vendor Advisory
• https://github.com/Aiven-Open/klaw/commit/617ed96b1db111ed498d89132321bf39f486e3a1 · Patch
• https://osv.dev/vulnerability/CVE-2026-25999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25999 · Security Note
• https://github.com/Aiven-Open/klaw/releases/tag/v2.10.2 · Note
• https://twitter.com/CVEnew/status/2021698419362816136 · Twitter Post