Redpanda Data's Redpanda service binds its administration interface to all network interfaces on port 9644 with the authentication requirement disabled by default. An attacker who can reach that port can issue privileged commands via the API, creating or deleting broker accounts, changing cluster configuration, and shutting down partition replication, effectively granting full administrative authority over the cluster. This flaw is a missing authentication weakness (CWE‑306) and carries a CVSS score of 9.3, indicating a critical vulnerability.

The vulnerability applies to Redpanda versions up through and including 26.2.2 when installed with the default configuration. Any deployment of Redpanda that has not applied the post‑26.2.2 patch or has not modified the default settings is potentially exposed.

The attack vector is remote network access to port 9644 on the host, with no authentication required. Because the default configuration exposes the interface on 0.0.0.0, an attacker within the network or over the internet can exploit it simply by sending API requests. With a CVSS score of 9.3 the flaw is classified as critical, and although EPSS data is not available and it is not yet listed in the CISA KEV catalog, the risk to an unpatched or misconfigured instance remains high, allowing an attacker to gain complete cluster control and disrupt service.