Vulnerability · Published Apr 5, 2026 · Assigned by VulDB

CVE-2026-5562provectus kafka-ui Endpoint testexecutions validateAccess code injection

High 7.3

In plain English

A high-severity code injection in kafka-ui from provectus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)2.6%top 14.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
provectus	kafka-ui	0.7.00.7.10.7.2

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-355332 | provectus kafka-ui Endpoint testexecutions validateAccess code injection vdb-entry, technical-description
VDB-355332 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #782941 | https://github.com/provectus/ kafka-ui 0.7.2 Code Injection third-party-advisory
https://drive.google.com/file/d/18-Q4tb19y_7dwchnTCgcwfbox0Uj6oQd/view exploit