CVE-2023-52251: Provectus Kafka UI command injection in message filter query

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit and very high EPSS, but it requires a low-privileged authenticated account and no fixed release exists to remediate quickly.

What it is

Kafka UI versions 0.4.0 through 0.7.2 pass the q parameter of the topic messages API endpoint into a message filter without safe handling, allowing code injection. An authenticated remote attacker can run arbitrary commands on the Kafka UI host. No fixed release exists and the project has had no commit since 2024-04-08, so the flaw remains unpatched in the affected line.

Impact

An attacker gains arbitrary code execution on the Kafka UI server, which typically holds cluster credentials and network reach into Kafka brokers, enabling data theft, message manipulation and lateral movement.

Attack surface

Reached over the network via the /api/clusters/local/topics/{topic}/messages endpoint using the q parameter. The CVSS vector requires low privileges (PR:L) and no user interaction, so a valid low-privileged Kafka UI account is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.8684 (99.7th percentile) and public exploit code exists per the Exploit-tagged reference, indicating active and easy exploitation.

What to do

• No fixed release is available; isolate or take Kafka UI 0.4.0-0.7.2 off untrusted networks and restrict access to trusted admin networks only.
• Track the kafbat/kafka-ui commit 11a57d14 and any successor project for a patched build, and migrate to a maintained fork.
• Enforce strong authentication and least privilege on Kafka UI accounts, since exploitation requires a low-privileged login.
• Run Kafka UI with a dedicated low-privilege OS account and restrict its outbound network access to only required Kafka brokers.
• Monitor the upstream advisory database and OSV issues for a fix and apply it as soon as one ships.

Detection

• Alert on requests to /api/clusters/*/topics/*/messages containing shell metacharacters or command strings in the q parameter.
• Monitor Kafka UI host process trees for unexpected child processes spawned by the Java service.
• Review Kafka UI access logs for anomalous query patterns or repeated message-filter requests from single accounts.
• Watch for outbound connections from the Kafka UI host to unfamiliar hosts that could indicate command-and-control or exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.