CVE-2026-123270 CVE-2026-123270
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123270?
CVE-2026-123270 is a critical vulnerability in Redpanda Data Connect, published on 9 Nov 2026.
Official description
Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. Starting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag.
Weakness: CWE-306
Which versions are affected by CVE-2026-123270?
How do I fix CVE-2026-123270?
No fix has been published for CVE-2026-123270 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123270 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123270 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-h882-2qpw-598h.