Klaw lacks sufficient access control over the endpoint that exposes user password hashes. This flaw permits an attacker to retrieve those hashes, which can then be cracked with off‑the‑shelf hashing tools, enabling credential reuse or privilege escalation. The weakness directly undermines confidentiality and is formally identified as CWE‑200 (Information Exposure) and CWE‑284 (Improper Access Control).

The vulnerability affects the Aiven‑Open:klaw product. Any installation running a version earlier than 2.10.4 is susceptible; version 2.10.4 and later contain the corrective code.

The CVSS score of 6.9 reflects medium to high risk. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Attack is likely carried out remotely via the web interface, targeting the exposed password‑hash endpoint. If the system is running in a shared or containerized environment, a local attacker that can reach the network may also exploit this flaw by sending an unauthenticated request to the vulnerable endpoint.