{"id":"CVE-2026-25999","aliases":["EUVD-2026-6199","GHSA-rp26-qv9w-xr5q"],"status":"published","title":"Klaw has an improper authorisation check on /resetMemoryCache","description":"Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00314,"percentile":0.24703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2026-02-11T21:00:30Z","modified":"2026-10-28T11:09:54Z","products":[{"vendor":"aiven","product":"klaw"},{"vendor":"aiven-open","product":"klaw"}],"references":[{"url":"https://github.com/Aiven-Open/klaw/security/advisories/GHSA-rp26-qv9w-xr5q","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/Aiven-Open/klaw/commit/617ed96b1db111ed498d89132321bf39f486e3a1","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/Aiven-Open/klaw/releases/tag/v2.10.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25999.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25999","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-25999","title":"Klaw has an improper authorisation check on /resetMemoryCache","description":"Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.","status":"published","published":"2026-02-11T21:00:30.271Z","modified":"2026-02-12T21:21:30.163Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-6199","description":"Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.","status":"published","published":"2026-02-11T21:00:30Z","modified":"2026-02-12T21:21:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:39.919829Z"}],"nvd":[{"id":"CVE-2026-25999","description":"Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.","status":"published","published":"2026-02-11T21:16:20.963Z","modified":"2026-06-17T10:25:34.333Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-25999","title":"Klaw has an improper authorisation check on /resetMemoryCache","description":"Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.","status":"published","published":"2026-02-11T21:00:30.271Z","modified":"2026-10-28T11:09:54.47366953Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:44:59.80315Z"}]}}