CVE-2026-44367: Klaw Apache Kafka Portal DoS Vulnerability

CVE-2026-44367 Overview

CVE-2026-44367 affects Klaw, a self-service Apache Kafka Topic Management and Governance portal maintained by Aiven. The vulnerability stems from inconsistent handling of username case sensitivity across the registration and login workflows. An authenticated attacker can exploit this inconsistency to register accounts that collide with existing usernames, producing targeted account lockout. The issue is classified as Improper Input Validation [CWE-20] and impacts all releases prior to version 2.10.4. Aiven addressed the flaw in Klaw 2.10.4.

Critical Impact

Authenticated users can trigger targeted Denial of Service and complete account lockout against specific Klaw accounts by abusing inconsistent case handling during registration.

Affected Products

• Klaw versions prior to 2.10.4
• Aiven-Open Klaw self-managed deployments
• Apache Kafka environments using Klaw for topic governance

Discovery Timeline

• 2026-06-02 - CVE-2026-44367 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-44367

Vulnerability Analysis

Klaw provides self-service workflows for Apache Kafka topic, schema, and ACL governance. The authentication subsystem handles username strings differently between the registration path and the login path. Registration accepts variations in case, while login normalizes or compares usernames against a different canonical form. This mismatch allows newly registered records to interfere with the ability of an existing user to authenticate.

The practical result is a targeted Denial of Service against named accounts. An attacker with the ability to submit user registrations can produce username collisions that prevent the legitimate account holder from logging in. Availability of the targeted account is fully impacted, while confidentiality and integrity of stored data remain unaffected. The flaw requires authenticated access to the registration mechanism but no user interaction from the victim.

Root Cause

The root cause is Improper Input Validation [CWE-20] in the user identity model. Klaw does not enforce a single canonical case representation for usernames across all code paths that read or write user records. Comparison logic in one workflow treats Alice and alice as distinct identifiers, while another workflow treats them as equivalent. This violates the uniqueness invariant the authentication layer depends on.

Attack Vector

The attack is delivered over the network against the Klaw web application. The attacker must hold credentials with the privilege required to invoke the user registration endpoint. After registration of a case-variant username, the targeted account becomes unreachable through the standard login flow. No code execution, data exfiltration, or privilege escalation occurs through this vector. See the GitHub Security Advisory GHSA-75rx-m9vh-mm9p for the upstream technical write-up.

Detection Methods for CVE-2026-44367

Indicators of Compromise

• New user records in the Klaw database that differ from existing usernames only by character case.
• Repeated failed login attempts from a previously functioning account immediately following a new registration event.
• Support tickets or help desk reports describing sudden inability to log in for specific named users.
• Registration activity originating from accounts with elevated provisioning privileges that targets existing usernames.

Detection Strategies

• Run periodic database queries against the Klaw user table to identify any pair of usernames that match under case-insensitive comparison.
• Correlate user registration events with subsequent authentication failures for similar usernames within a short time window.
• Alert on registration attempts where the submitted username, after case folding, equals an existing account identifier.

Monitoring Recommendations

• Forward Klaw application logs and authentication events to a centralized log platform for retention and correlation.
• Track baseline registration volume and alert on deviations, especially from privileged provisioning accounts.
• Monitor login failure rates per user account and trigger investigation when an account transitions from successful to consistently failing logins.

How to Mitigate CVE-2026-44367

Immediate Actions Required

• Upgrade all Klaw deployments to version 2.10.4 or later, as published in the GitHub Release v2.10.4.
• Audit the existing Klaw user table for case-variant duplicates and remediate any collisions before applying the patch.
• Restrict access to the user registration endpoint to a minimal set of administrative roles until the upgrade is complete.
• Review recent registration activity for evidence of abuse against valid accounts.

Patch Information

Aiven released the fix in Klaw 2.10.4. The release enforces consistent case handling across registration and login workflows and prevents the creation of users whose names collide with existing accounts under case-insensitive comparison. Refer to the GitHub Release v2.10.4 notes for the full change set.

Workarounds

• Limit user registration permissions to trusted administrators until upgrading to 2.10.4.
• Implement an external validation step that rejects new usernames matching any existing username under case-insensitive comparison.
• Monitor and rapidly revert any user records created with case-variant collisions against active accounts.