CVE-2026-123270
CriticalCVSS 9.8Summary
Redpanda Connect versions 4.39 to 4.110 expose the management HTTP API on 0.0.0.0:4195 with authentication disabled by default, allowing an unauthenticated attacker with network access to TCP/4195 to achieve remote code execution (RCE). An attacker can POST a malicious pipeline definition to /streams/{id} containing code-executing processors (command, subprocess, ffi, sql_raw), achieving arbitrary command execution with the Redpanda Connect service account permissions. Starting with v4.111 the API is opt-in and no longer vulnerable by default, but RCE remains possible if the management API is manually enabled via --bind-http.
Risk Assessment
Full host compromise, credential theft, and data exfiltration with no user interaction or credentials required if the management API is network-reachable. High risk in environments where port 4195 is exposed beyond a trusted network.
Recommendation
Upgrade Redpanda Connect to version 4.111 or later and ensure the management API is not enabled via the --bind-http flag. Restrict network access to TCP/4195 to trusted addresses and enforce authentication if the API must be used.
Related vulnerabilities
- CVE-2026-123800Critical
SuperTokens Core versions from 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1 contain a flaw in Multitenancy.checkPermissionsForCreateOrUpdate that does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate API keys, an attacker holding one application's valid API key can update the parent domain, replace sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's key. The v2 create or update handlers, when the optional identifier is omitted, produce a base-tenant target that skips permission branches and the enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags affecting login integrity and availability; the base-target variant still rejects coreConfig and does not establish key theft. The issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
- CVE-2026-119756Critical
Tasmota through 16.0.0 (fixed in commit e97e1e4) contains a heap out-of-bounds write in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447. The messages cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. This can crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms lacking ASLR and heap cookies.
- CVE-2026-104989Critical
An uncontrolled search path element in the package upload feature in Chaos Software V-Ray through version 2.0.19 allows remote unauthenticated attackers to execute arbitrary code by redirecting access to libraries.
- CVE-2026-124079Critical
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability. An unauthenticated attacker can push a crafted serialized job onto the Redis-backed Laravel Horizon queue, leading to arbitrary code execution via the App\Jobs\TaskDownloadRun class and the bundled laravel/tinker package.
- CVE-2026-110469Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
- CVE-2026-110468Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
- CVE-2026-118462Critical
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- CVE-2026-115252Critical
The Confection WordPress Cable plugin from 0.4.0 to 0.4.7 does not perform capability or nonce checks before saving its settings and writes one of them unmodified into a standalone PHP file that it then serves. This allows unauthenticated users to execute arbitrary PHP code on the server.
- CVE-2026-124585Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP devices within the web administration interface. The add_expmac function in var/html/webserver mishandles the mac argument, resulting in OS command injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-123870Critical
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When GITHUB_WEBHOOK_SECRET is unset or empty (default None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the host.
Original NVD description (English source)
Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. Starting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS