CVE-2026-25999 Klaw has an improper authorisation check on /resetMemoryCache

High 7.1 Published 11 Feb 2026 Updated 12 Feb 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-25999?

CVE-2026-25999 is a high-severity vulnerability in Aiven-Open klaw, published on 11 Feb 2026.

Official description

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.

Weakness: CWE-285

Which versions are affected by CVE-2026-25999?

It affects 1 product.

Products include Aiven Klaw.

How do I fix CVE-2026-25999?

No fix has been published for CVE-2026-25999 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-25999 being exploited?

There is no known exploitation of CVE-2026-25999 in the wild and no public exploit code.

Sources

Also known as GHSA-rp26-qv9w-xr5q.