Description
A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-24
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in the executeSmartFilterTest function of provectus kafka‑ui that allows arbitrary Groovy code to be injected and executed. The flaw arises from improper handling of user-supplied input, enabling code injection (CWE‑74) and Groovy evaluation injection (CWE‑94). Exploiting this flaw could lead to full compromise of the system running kafka‑ui, impacting confidentiality, integrity, and availability.

Affected Systems

The affected product is provectus kafka‑ui up to and including version 0.7.2. Any installation of these versions is vulnerable; later releases that address the issue are not specified in the data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available, but the exploit has been released publicly, meaning an attacker can successfully leverage the flaw. The vulnerability is not listed in the CISA KEV catalog, yet the remote code execution potential and public exploit make the risk significant for exposed deployments.

Generated by OpenCVE AI on August 24, 2026 at 02:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade provectus kafka‑ui to the latest available release that includes the fix for the executeSmartFilterTest code injection vulnerability.
  • If an upgrade is not immediately possible, restrict or disable access to the executeSmartFilterTest endpoint and enforce strict authentication and authorization controls on all API routes.
  • Apply input validation or remove the Groovy code execution capability altogether, ensuring that downstream components no longer process untrusted code.

Generated by OpenCVE AI on August 24, 2026 at 02:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection
First Time appeared Provectus
Provectus kafka-ui
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:provectus:kafka-ui:*:*:*:*:*:*:*:*
Vendors & Products Provectus
Provectus kafka-ui
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Provectus Kafka-ui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-24T01:00:11.519Z

Reserved: 2026-08-23T13:57:16.161Z

Link: CVE-2026-78166

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T02:17:04.120

Modified: 2026-08-24T02:17:04.120

Link: CVE-2026-78166

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T02:30:10Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')