CVE-2026-25999

MEDIUM 4.3CVE-2026-25999 · Published 11/02/2026 · updated 17/06/2026

In short

CVE-2026-25999 is a MEDIUM (CVSS 4.3) vulnerability affecting klaw (aiven).
Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 23.7% of all vulnerabilities.
Fix: update to 2.10.2 or later.

Package	Affected versions	Patched versions
klaw aiven	`< 2.10.2`	`2.10.2`

Description

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.

References

Aiven-Open/klaw commit 617ed96 · Patch
Aiven-Open/klaw release v2.10.2 · Product
Aiven-Open/klaw security advisory · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free