An improper authorization check on the /resetMemoryCache endpoint allows unauthenticated users to clear cached configurations, environments, and cluster data for any tenant. This can lead to loss of critical metadata, service disruption, and potential exposure of sensitive configuration details. The vulnerability is a remote flaw that could be exploited by sending a crafted request to the exposed API.

The issue affects all instances of Aiven‑Open Klaw older than version 2.10.2. Version 2.10.2 and later contain the fix, so any deployment running 2.10.1 or earlier is considered vulnerable.

With a CVSS score of 7.1 and an EPSS of less than 1 %, the technical severity is moderate while the likelihood of exploitation is considered low. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. A malicious actor can trigger the reset simply by accessing the endpoint, so the attack vector is network‑based and does not require privileged credentials. The impact is the ability to disrupt tenant services and erase cached state without authorization.