CVE-2026-5562 is a high severity code injection flaw (CVSS 7.3) in provectus kafka-ui up to 0.7.2. It sits in validateAccess behind the /api/smartfilters/testexecutions endpoint and can be reached remotely. The record says the exploit is public and the vendor did not respond. No fixed version is listed.
What's affected
- provectus kafka-ui up to and including 0.7.2, per the record.
- Fixed version: none listed. The record says the vendor was contacted early and did not respond. Check the project releases for anything newer than 0.7.2.
- The affected endpoint is /api/smartfilters/testexecutions.
How to check if you're exposed
Find any Kafka UI instances and read their versions.
docker ps --format "{{.Image}}" | grep -i kafka-ui
kubectl get pods -A -o jsonpath='{..image}' | tr -s ' ' '\n' | grep -i kafka-ui
Then check who can reach the web interface and whether it sits behind authentication. Unauthenticated Kafka UI instances are common, and the record scores this flaw as needing no login.
What to do now
- Look at the project releases for a version newer than 0.7.2 that addresses the issue, and upgrade if one exists.
- Put Kafka UI behind authentication and a VPN or private network, and do not expose it to the internet.
- Block the smart filters test endpoint at your reverse proxy if you do not use that feature.
- Give the UI only the Kafka permissions it needs, since injected code runs with its access.
- Review the host for unexpected processes.
Why it matters
The classes are CWE-74, CWE-94: improper neutralization of special elements in output, and code injection. The record says the problem lies in access validation within the smart filters test function, which runs filter text supplied by the caller. The record gives no further details, and neither does this post.
The record notes a public exploit, but it does not mark the CVE as exploited in the wild. Admin consoles for data platforms should never face the open internet. Where the vendor is silent, network controls are the dependable defense.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Will a vendor patch arrive?
Unknown. The record says the vendor did not respond to the disclosure, so rely on network controls and watch the project releases.
Sources
Last reviewed: 19 October 2026.
