Vulnerability · Published Jun 6, 2025 · Assigned by GitHub_M
CVE-2025-49127Kafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration
High 8.9
In plain English
A high-severity unsafe deserialization in kafka-ui from kafbat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.6%top 50.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
References
- https://github.com/kafbat/kafka-ui/security/advisories/GHSA-g3mf-c374-fgh2 x_refsource_CONFIRM
- https://github.com/kafbat/kafka-ui/releases/tag/v1.1.0 x_refsource_MISC