CVE-2026-82266: Redpanda Admin API Auth Bypass Vulnerability

CVE-2026-82266 Overview

CVE-2026-82266 is a critical missing authentication vulnerability [CWE-306] affecting Redpanda through version 26.2.2. The Redpanda Admin API binds to 0.0.0.0:9644 by default, while the admin_api_require_auth configuration option defaults to false. As a result, Redpanda treats every unauthenticated request reaching port 9644 as originating from a superuser. Attackers with network reach to the Admin API can create and delete broker accounts, modify cluster configuration, and disrupt partition replication without supplying any credentials.

Critical Impact
Unauthenticated network attackers can achieve full administrative control over a Redpanda streaming cluster, including account manipulation, configuration tampering, and data plane disruption.

Affected Products

Redpanda versions through 26.2.2
Deployments using the default redpanda.yaml configuration
Any cluster exposing TCP port 9644 to untrusted networks

Discovery Timeline

2026-08-28 - CVE-2026-82266 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82266

Vulnerability Analysis

Redpanda exposes an Admin API on TCP port 9644 for cluster management operations such as user creation, ACL updates, configuration changes, and partition control. The default configuration binds this listener to 0.0.0.0, making it reachable on every network interface. The admin_api_require_auth flag governs whether the server enforces authentication on incoming Admin API requests.

By default, this flag is set to false. The request authentication logic in src/v/security/request_auth.cc interprets absent credentials as an anonymous request and elevates that request to superuser context. This grants complete administrative privileges without any authentication challenge.

The issue is a configuration and design flaw rather than a memory safety bug. Any operator who deploys Redpanda without explicitly overriding the default listener address and auth flag exposes the entire control plane. See the VulnCheck advisory for additional context.

Root Cause

The root cause is insecure default configuration [CWE-306]. Two defaults combine to produce the vulnerability: the Admin API listener bound to all interfaces and the authentication requirement disabled. The server-side authentication handler then maps unauthenticated callers to a superuser identity rather than rejecting them. Reference the Redpanda configuration file and the request auth source for implementation specifics.

Attack Vector

An attacker with network access to port 9644 issues standard HTTP requests against the Admin API endpoints. No credentials or tokens are required. The server processes each call with superuser privileges, enabling account creation and deletion, cluster configuration mutation, and partition replication disruption. Because the attack requires only network reachability, exposed instances in cloud environments, Kubernetes clusters with permissive network policies, or flat internal networks are directly reachable. See Redpanda GitHub issue #30989 for the tracking discussion.

No verified public proof-of-concept code was released with the advisory. Exploitation consists of standard REST calls to Admin API routes such as user management, cluster config, and partition endpoints.

Detection Methods for CVE-2026-82266

Indicators of Compromise

Unexpected Admin API requests originating from non-administrative source IP addresses on TCP port 9644.
New broker user accounts or superuser entries that do not correspond to provisioning workflows.
Cluster configuration changes, ACL modifications, or partition rebalancing events without a corresponding change ticket.

Detection Strategies

Inspect the Redpanda Admin API access logs for requests lacking authentication headers or presenting anonymous identities mapped to superuser.
Correlate Admin API activity on port 9644 with allow-listed administrator source addresses; flag any deviation.
Alert on write operations against user management, ACL, and configuration endpoints outside change windows.

Monitoring Recommendations

Forward Redpanda Admin API access logs and audit events to a centralized SIEM for retention and correlation.
Monitor firewall and cloud security group telemetry for inbound connections to port 9644 from unexpected networks.
Track cluster configuration drift and user account inventory changes using scheduled integrity checks.

How to Mitigate CVE-2026-82266

Immediate Actions Required

Set admin_api_require_auth: true in redpanda.yaml and restart brokers to enforce authentication on all Admin API requests.
Rebind the Admin API listener from 0.0.0.0 to a management-only interface or 127.0.0.1 where possible.
Restrict TCP port 9644 with host firewalls, cloud security groups, and Kubernetes NetworkPolicies to a defined administrator source range.
Rotate broker credentials and audit existing user accounts, ACLs, and cluster configuration for unauthorized changes.

Patch Information

At the time of NVD publication, Redpanda versions through 26.2.2 are affected. Consult the Redpanda GitHub repository and issue #30989 for the current fixed release and any updated default configuration guidance. Upgrade to the vendor-designated fixed version once available and confirm that post-upgrade defaults require authentication.

Workarounds

Enable admin_api_require_auth and provision explicit superuser credentials before exposing the Admin API.
Place the Admin API behind a reverse proxy or bastion that enforces mutual TLS and network-level authentication.
Segment Redpanda clusters onto dedicated management VLANs or private subnets unreachable from workload networks.

bash

# Configuration example: redpanda.yaml hardening
redpanda:
  admin:
    - address: 127.0.0.1
      port: 9644
  admin_api_require_auth: true
  superusers:
    - admin