CVE-2026-78166: Provectus Kafka-UI RCE Vulnerability

CVE-2026-78166 Overview

CVE-2026-78166 is a code injection vulnerability in Provectus Kafka-UI versions up to 0.7.2. The flaw resides in the executeSmartFilterTest function within kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java, part of the Groovy Code Handler component. An authenticated remote attacker can manipulate input passed to this handler to inject and execute arbitrary Groovy code. Public exploit details have been released, increasing the practical risk of exploitation. The Provectus project was notified through an issue report but has not responded at the time of publication.

Critical Impact
Authenticated remote attackers can inject Groovy code through the smart filter functionality, leading to code execution within the Kafka-UI backend context.

Affected Products

Provectus Kafka-UI versions up to and including 0.7.2
Deployments exposing the Kafka-UI web interface (MessagesController)
Environments using the Smart Filter (Groovy) feature for message inspection

Discovery Timeline

2026-08-24 - CVE-2026-78166 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78166

Vulnerability Analysis

The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Kafka-UI provides a Smart Filter feature that lets users write Groovy expressions to filter Kafka messages. The executeSmartFilterTest endpoint accepts a user-supplied Groovy script and evaluates it server-side. Because the input is passed to the Groovy engine without sufficient neutralization, an attacker can craft an expression that escapes the intended filter context and executes arbitrary logic within the Java Virtual Machine hosting Kafka-UI.

Exploitation requires network access to the Kafka-UI API and low-privileged authenticated access, per the CVSS 4.0 vector. Impact is limited to the confidentiality, integrity, and availability of the vulnerable Kafka-UI instance itself. The EPSS probability sits at 0.305%.

Root Cause

The root cause is direct evaluation of user-controlled Groovy source in executeSmartFilterTest without a sandbox, allow-list, or SecureASTCustomizer restricting available classes and methods. Groovy's dynamic evaluation exposes JVM classes such as java.lang.Runtime and ProcessBuilder to any expression that is not explicitly constrained.

Attack Vector

An attacker with a valid Kafka-UI account sends a crafted HTTP request to the smart filter test endpoint carrying a malicious Groovy payload in the filter body. The server compiles and executes the script, allowing the attacker to invoke arbitrary JVM APIs, read files accessible to the Kafka-UI process, and interact with the connected Kafka clusters. The vulnerability manifests in MessagesController.executeSmartFilterTest. See the VulDB CVE-2026-78166 record and the GitHub Issue #4567 for further technical detail.

Detection Methods for CVE-2026-78166

Indicators of Compromise

HTTP POST requests to Kafka-UI smart filter endpoints containing Groovy tokens such as Runtime.getRuntime, ProcessBuilder, execute(), or Eval.me.
Unexpected child processes spawned by the Kafka-UI Java process (sh, bash, curl, wget, nc).
Outbound network connections initiated by the Kafka-UI container to previously unseen destinations.

Detection Strategies

Inspect Kafka-UI access logs for repeated calls to the executeSmartFilterTest route from a single account or IP.
Monitor JVM behavior for reflective class loading or dynamic script compilation events originating from message controllers.
Correlate Kafka-UI authentication events with subsequent process or file system activity on the host.

Monitoring Recommendations

Forward Kafka-UI application and container logs to a centralized SIEM for retention and search.
Alert on Java processes creating shells or invoking network utilities inside Kubernetes or container runtimes.
Track anomalous egress traffic from Kafka-UI pods, particularly to non-corporate destinations.

How to Mitigate CVE-2026-78166

Immediate Actions Required

Restrict network access to Kafka-UI so only trusted operators can reach the management interface.
Disable or gate the Smart Filter (Groovy) feature until an upstream fix is available.
Rotate credentials for any Kafka clusters, service accounts, or secrets accessible to the Kafka-UI process.

Patch Information

No vendor patch is available at the time of publication. The maintainers were notified through an upstream issue report but have not responded. Track the Provectus Kafka-UI repository for updates and apply fixes when released.

Workarounds

Place Kafka-UI behind an authenticating reverse proxy and restrict access by IP allow-list or VPN.
Run Kafka-UI as a low-privileged user in a container with a read-only root filesystem and no outbound internet access.
Remove permissions for the Smart Filter feature from all non-administrative roles via Kafka-UI's role configuration.
Consider migrating to a maintained fork if upstream remains unresponsive to security reports.

bash

# Example: restrict Kafka-UI egress and drop shell spawning capabilities in Kubernetes
securityContext:
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]