Redpanda versions through 26.2.2 expose their Admin API on 0.0.0.0:9644 with authentication disabled by default (admin_api_require_auth=false). This configuration causes the system to treat all unauthenticated requests as superuser-level, allowing any attacker who can reach port 9644 to gain full administrative control. Attackers can exploit this to create and delete broker accounts, modify cluster configurations, and disrupt partition replication. The vulnerability stems from an insecure default configuration rather than a code flaw. No credentials are required to exploit this issue, making it accessible to unskilled attackers on exposed deployments. The issue affects data streaming and messaging infrastructure built on Redpanda, potentially impacting data integrity and availability. Organizations running Redpanda should immediately enable authentication on the Admin API or restrict network access to port 9644.
