CVE-2026-123270

Summary

Redpanda Connect versions 4.39–4.110 expose an unauthenticated management HTTP API on port 4195 by default in streams mode, allowing unauthenticated remote code execution via malicious pipeline definitions that include dangerous processors like 'command' or 'subprocess'. This enables full host compromise without credentials or user interaction.

Exploitability

Exploitation is trivial for an attacker with network access to TCP/4195; no authentication, user interaction, or special conditions are required.

Blast radius

Successful exploitation grants the attacker arbitrary code execution with the privileges of the Redpanda Connect service account, enabling credential theft, data exfiltration, lateral movement, and full host compromise.

Detection

Defenders should monitor for HTTP POST requests to /streams/{id} on port 4195 from untrusted sources, especially those containing pipeline definitions with processors such as 'command', 'subprocess', 'ffi', or 'sql_raw'; also watch for unexpected child processes spawned by the Redpanda Connect service (e.g., shell commands, external binaries) and anomalous outbound network connections originating from the service.

Prioritized remediation

Upgrade to Redpanda Connect v4.111 or later and ensure the management API is not enabled via the --bind-http flag; if the API must be used, restrict access to trusted networks using firewall rules and enable authentication.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.