CVE-2026-25999
📋 TL;DR
CVE-2026-25999 is an improper access control vulnerability in Klaw (Apache Kafka management portal) that allows unauthorized users to reset or delete metadata for any tenant by sending crafted requests to the /resetMemoryCache endpoint. This affects all Klaw deployments prior to version 2.10.2, potentially disrupting Kafka topic management operations.
💻 Affected Systems
- Klaw (Apache Kafka Topic Management Portal)
📦 What is this software?
Klaw by Aiven
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of Kafka topic management operations across all tenants, requiring manual restoration of configurations and potentially causing service outages.
Likely Case
Temporary disruption of Klaw functionality requiring administrators to manually reload configurations, causing operational delays.
If Mitigated
Minimal impact with proper network segmentation and authentication controls preventing unauthorized access to the vulnerable endpoint.
🎯 Exploit Status
Exploitation requires only a simple HTTP request to the vulnerable endpoint with no authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.2
Vendor Advisory: https://github.com/Aiven-Open/klaw/security/advisories/GHSA-rp26-qv9w-xr5q
Restart Required: Yes
Instructions:
1. Backup current Klaw configuration and data. 2. Stop the Klaw service. 3. Update to version 2.10.2 using your package manager or manual installation. 4. Restart the Klaw service. 5. Verify the fix by checking the version and testing the /resetMemoryCache endpoint.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the Klaw instance to only authorized users and systems.
iptables -A INPUT -p tcp --dport [KLAW_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [KLAW_PORT] -j DROP
Endpoint Blocking via Reverse Proxy
allBlock access to the /resetMemoryCache endpoint at the reverse proxy or load balancer level.
location /resetMemoryCache { deny all; return 403; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Klaw from untrusted networks
- Add authentication middleware or WAF rules to block unauthorized requests to /resetMemoryCache
🔍 How to Verify
Check if Vulnerable:
Check if Klaw version is below 2.10.2 and if unauthenticated requests to /resetMemoryCache endpoint are accepted.Check Version:
curl -s http://[KLAW_HOST]:[PORT]/api/version | grep versionVerify Fix Applied:
Verify Klaw version is 2.10.2 or higher and test that unauthenticated requests to /resetMemoryCache return proper authentication errors.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to POST /resetMemoryCache from unauthorized IPs
- Unusual spike in configuration reload events
Network Indicators:
- HTTP POST requests to /resetMemoryCache endpoint without authentication headers
- Traffic to Klaw from unexpected source IPs
SIEM Query:
source="klaw.log" AND (uri_path="/resetMemoryCache" AND http_method="POST" AND NOT user_authenticated="true")