CVE-2026-123270

Name of the Vulnerable Software and Affected Versions Redpanda Connect versions 4.39 through 4.110

Description In streams mode, the management HTTP API is exposed on 0.0.0.0:4195 without authentication enabled by default, leaving stream CRUD routes unprotected. An unauthenticated attacker with network access to TCP/4195 can send a POST request to the /streams/{id} endpoint with a malicious pipeline definition. By utilizing code-executing processors such as command, subprocess, ffi, or unsafe sql raw, the attacker can achieve arbitrary remote code execution (RCE) on the host with the permissions of the service account. This allows for full host compromise, credential theft, and data exfiltration, as pipelines can return command output in-band via HTTP.

Recommendations Update to version 4.111 or later. Avoid manually enabling the management API via the --bind-http flag in versions 4.111 and later to prevent the risk of remote code execution.