Redpanda Connect Streams Mode Unauthenticated RCE (CVE-2026-123270)

Redpanda Connect can run in streams mode, where a management HTTP API lets an operator add, inspect and remove data pipelines ("streams") while the process keeps running. The CVE record says this API is served on 0.0.0.0:4195, every network interface, and that authentication is off by default with no gate in front of the stream-management routes.

The CVE record says an unauthenticated caller who can reach that port can load a pipeline definition that includes a processor built to run operating-system commands or raw SQL. Per the record, the pipeline then runs with the permissions of the Redpanda Connect service account, and its output can be returned over the same HTTP connection. We leave out the specific route and request shape on purpose.

What an Attacker Gains

The CVE record describes this as full host compromise: credential theft and data exfiltration, with no user interaction and no credentials required. Our remote code execution entry explains that impact class.

The record adds a version boundary. Starting with Redpanda Connect 4.111, the management API endpoint became opt-in rather than on by default, so that version and later are not exposed this way out of the box. The record is explicit that remote code execution is still reachable on 4.111 and later if an operator turns the API back on with its bind flag.

What Redpanda's Own Material Says

No dedicated Redpanda security advisory for this CVE turned up in our research as of 10 November 2026. Redpanda's own streams-mode documentation carries a warning box on this exact setting. It says the streams-mode API is disabled by default from version 4.111.0 onward. The box tells an operator who re-enables it to bind the HTTP server to a trusted interface, turn on basic authentication, or both.

That documentation page was last modified 31 October 2026, five days before the CVE was reserved. We read the default-off change in 4.111 and this warning box as Redpanda's own response to the exposure the CVE record now describes, even without a separate GHSA.

How the Score Reads

CISA's ADP Vulnrichment scores CVE-2026-123270 at CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD lists that score as a secondary source; its own entry shows status Received, meaning NVD has not yet published an independent score. There is no CVSS 4.0 score in the record or NVD. See our CVSS entry for how to read the vector.

What CISA's SSVC and KEV Say

CISA's ADP Vulnrichment SSVC assessment, dated 9 November 2026, lists Exploitation as "none," Automatable as "yes," and Technical Impact as "total." As of CISA catalog version 2026.11.09, the CVE is not in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog.

The CVE record's only reference is a single proof-of-concept repository. GitHub's own record shows it was created on 14 September 2026, eleven days before Redpanda Connect 4.111 shipped its default-off change. We do not name or link that repository.

The CVE record lists one continuous affected range for Redpanda Connect, covering every point release from 4.39 through 4.110. It names Redpanda Data as the vendor and Connect as the single affected product.

The record is explicit that 4.111 and later only stop being exposed by default. The same remote code execution path is still reachable on any version, including 4.111 and later, if an operator manually re-enables the management API's bind flag without separately adding authentication.

We recommend treating "upgrade to 4.111 or later" as a fix for default exposure, not a complete fix. Check your own startup flags and network bindings regardless of version.