CVE-2025-49127

Kafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration

State: Published
Severity: 8.9 High
Published: Jun 6, 2025
Updated: Jun 9, 2025
Reserved: Jun 2, 2025

Description

Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
4.0	8.9 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	GitHub_M

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
kafka-uikafbat	= 1.0.0Affected

References

https://github.com/kafbat/kafka-ui/security/advisories/GHSA-g3mf-c374-fgh2
https://github.com/kafbat/kafka-ui/releases/tag/v1.1.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.