CVE-2023-52251: Provectus Kafka UI code injection leading to remote code execution
The short version: Provectus Kafka UI — a popular open-source web front-end for Apache Kafka — has a code-injection flaw (CVE-2023-52251) in the message-filtering feature that lets an attacker execute arbitrary code on the server. It is not in CISA's KEV catalog, but public exploit code exists and the flaw is trivially automatable, so an exposed instance should be treated as an RCE risk. Steady hands — get it off the internet and patched.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — remote code execution, no vendor-hardened default auth |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~85.03% · 99.69th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in-the-wild by an authoritative catalog; public proof-of-concept exploit code exists |
| Vulnerability type | CWE-94 code injection → arbitrary code execution on the server |
| Requires authenticated session? | NVD scores it privileges-required-low; Kafka UI historically ships without authentication enabled, so many instances are effectively unauthenticated |
| Affected | Provectus Kafka UI 0.4.0 through 0.7.1 |
| Fixed in | Unknown at time of writing — apply the latest release and enable authentication |
What you need to know
Kafka UI is a web dashboard for browsing Kafka clusters, topics, and messages. CVE-2023-52251 lives in the message-filtering path: the q parameter used to filter messages in a topic is evaluated in a way that lets an attacker inject and run code, yielding execution on the host running Kafka UI.
- How they find it — internet-wide scanning and the distinctive Kafka UI interface make exposed instances easy to spot.
- How they use it — a crafted filter expression turns a read-only dashboard into code execution; public PoC code lowers the bar to automated abuse.
- What it leads to — a foothold on the host, and from there access to the Kafka cluster the dashboard was built to manage — brokers, topics, and the data flowing through them.
How serious we see it
High — remote code execution, with the reach determined by where the dashboard sits.
NVD scores it 8.8 and lists privileges-required-low, but Kafka UI has historically run without authentication unless an operator turns it on, so in the real world many instances are reachable with no credential at all. It isn't in KEV and we're not claiming confirmed mass exploitation, but working exploit code is public and the technique is easy to automate — reason enough to treat an internet-facing instance as an active RCE exposure. The reassuring part: this is infrastructure you control, and it should almost never be on the open internet in the first place.
Recommendations
- Get it off the public internet. Kafka UI is an internal operations tool; restrict it to trusted networks or a VPN.
- Upgrade. Move to the latest Provectus Kafka UI release and track the project's security notes for the fixed build.
- Require authentication. Enable and enforce authentication on the dashboard rather than relying on network position alone.
- If it was exposed, respond. Assume the host and the Kafka cluster it fronts may have been reached; review for unexpected activity and rotate affected credentials.
- Confirm your exposure first. Verify whether any Kafka UI instance is reachable from the internet, and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Kafka UI instances from little more than your domain, fingerprints the product and version, and flags exposure tied to this code-injection flaw. We detect and prioritize the exposed, affected instance — an admin dashboard on the internet is exactly the kind of quietly-stood-up service that gets forgotten — so it surfaces as a finding before someone else turns the filter box into a shell.