CVE-2026-5562: Provectus kafka-ui code injection in validateAccess test executions endpoint
CVE-2026-5562 is a code injection weakness (CWE-74) in the validateAccess function of the /api/smartfilters/testexecutions endpoint in Provectus kafka-ui up to and including 0.7.2. The record reports remote reachability, an NVD CVSS score of 9.8, and a publicly available exploit, while no fixed version is listed. Affected deployments should restrict access to the interface and plan an upgrade once a fix is confirmed.
Overview
A code injection weakness (CWE-74, Injection) was identified in Provectus kafka-ui. According to the record, the flaw is in the validateAccess function of the /api/smartfilters/testexecutions endpoint and affects versions up to and including 0.7.2. The issue is reported as remotely reachable, and the record states that a public exploit is available.
Impact
- The NVD vector in the record indicates high impact on confidentiality, integrity and availability, with no privileges or user interaction required.
- Scores from other providers in the record range from 5.5 to 7.5, so perceived severity depends on the scoring source.
- SSVC data in the record rates exploitation at a proof-of-concept level and marks the issue as automatable.
Affected products and versions
- Provectus Kafka-ui from 0.7.0 up to and including 0.7.2, as listed in the record.
- The record also lists a related Provectus Ui entry for the same range; confirm whether it applies to your deployment.
Exploitation status
The CVE is not listed in the CISA KEV catalog in the record. The record states that an exploit is publicly available and might be used, and SSVC reports a proof-of-concept exploitation level. No confirmed active exploitation appears in the sources consulted.
Remediation and mitigation
- The record lists no fixed version. Check the project's releases and maintainer communications for a version newer than 0.7.2 and plan an upgrade.
- The record states the vendor did not respond to early disclosure, so do not assume an official fix exists.
- Until a fix is confirmed, restrict network access to the kafka-ui interface, place it behind authentication, and limit who can reach administrative or smart-filter functions.
- Review whether the affected endpoint is exposed to untrusted networks and remove that exposure where possible.
Detection guidance
- Review web server and application logs for requests to the smart-filter test execution path from unexpected sources.
- Monitor the host running kafka-ui for unexpected child processes or outbound connections.
- Correlate alerts with authentication logs to identify anonymous or unusual access to the endpoint.
Limitations of the available information
- No fixed version, patch or vendor advisory is present in the record.
- Details of the vulnerable code path are limited to the function name and endpoint; no technical verification was performed.
- Scores vary across providers, and the EPSS entry carries a date that should be checked against the source.
- The record does not state whether Provectus Ui is a separate deployable product.
Frequently asked questions
Which versions of Provectus kafka-ui are affected by CVE-2026-5562?
The record lists versions from 0.7.0 up to and including 0.7.2 and describes the issue as affecting versions up to 0.7.2.
Is there a fix for CVE-2026-5562?
The record does not list any fixed version, and it states the vendor did not respond to early disclosure. Check the project's releases and maintainer communications for updates.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit is available.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.