A critical vulnerability in Redpanda versions through 26.2.2 allows unauthenticated remote attackers to gain full administrative control over the cluster via the Admin API.

The vulnerability stems from an insecure default configuration where the Admin API, bound to port 9644, fails to enforce authentication. Consequently, any unauthenticated request is treated with superuser privileges, granting full read and write access to cluster configuration and management functions.

The ability for an unauthenticated attacker to manipulate cluster configuration, delete broker accounts, and disrupt partition replication poses a severe risk to data availability and integrity. Given the CVSS score of 9.8, this vulnerability represents a critical threat that could lead to complete service outages or unauthorized access to sensitive data streams managed by the Redpanda cluster.

Immediate Action: Upgrade Redpanda to the latest available version where the Admin API authentication default is secure, or explicitly set the admin_api_require_auth configuration parameter to true in the redpanda.yaml file.

Proactive Monitoring: Review access logs for port 9644 to identify requests originating from unauthorized IP addresses or suspicious administrative commands.

Compensating Controls: Implement network-level access control lists (ACLs) or a Web Application Firewall (WAF) to restrict traffic to the Admin API port (9644) to trusted management subnets only.

Public Exploit Available: Unknown

This is a critical security flaw that requires immediate attention from all administrators managing Redpanda deployments. Organizations should prioritize updating their software or verifying their configuration settings to ensure that authentication is strictly enforced for all administrative endpoints, thereby preventing unauthorized cluster-wide access.