CVE-2025-49127: Kafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration

Severity: high (CVSS 8.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-06 · updated 2026-06-17
Weakness: CWE-502

Description

Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue.

Affected products

kafbat kafka-ui: = 1.0.0

References

https://github.com/kafbat/kafka-ui/releases/tag/v1.1.0
https://github.com/kafbat/kafka-ui/security/advisories/GHSA-g3mf-c374-fgh2
https://github.com/kafbat/kafka-ui/security/advisories/GHSA-g3mf-c374-fgh2

Get alerted when CVE-2025-49127 or the next vulnerability affects your stack