{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78166", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-23T13:57:16.161Z", "datePublished": "2026-08-24T01:00:11.519Z", "dateUpdated": "2026-08-26T18:10:41.209Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-24T01:00:11.519Z"}, "title": "provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "provectus", "product": "kafka-ui", "versions": [{"version": "0.7.0", "status": "affected"}, {"version": "0.7.1", "status": "affected"}, {"version": "0.7.2", "status": "affected"}], "cpes": ["cpe:2.3:a:provectus:kafka-ui:*:*:*:*:*:*:*:*"], "modules": ["Groovy Code Handler"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-23T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-23T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-23T16:02:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "geochen (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/394555", "name": "VDB-394555 | provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394555/cti", "name": "VDB-394555 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-78166", "name": "CVE-2026-78166 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/883727", "name": "Submit #883727 | provectus kafka-ui 0.7.2 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/provectus/kafka-ui/issues/4567", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/provectus/kafka-ui/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T18:10:28.887286Z", "id": "CVE-2026-78166", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:10:41.209Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78166", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T18:10:28.887286Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:10:37.547Z"}}], "cna": {"title": "provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection", "credits": [{"lang": "en", "type": "reporter", "value": "geochen (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:provectus:kafka-ui:*:*:*:*:*:*:*:*"], "vendor": "provectus", "modules": ["Groovy Code Handler"], "product": "kafka-ui", "versions": [{"status": "affected", "version": "0.7.0"}, {"status": "affected", "version": "0.7.1"}, {"status": "affected", "version": "0.7.2"}]}], "timeline": [{"lang": "en", "time": "2026-08-23T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-23T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-23T16:02:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/394555", "name": "VDB-394555 | provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/394555/cti", "name": "VDB-394555 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-78166", "name": "CVE-2026-78166 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/883727", "name": "Submit #883727 | provectus kafka-ui 0.7.2 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/provectus/kafka-ui/issues/4567", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/provectus/kafka-ui/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-24T01:00:11.519Z"}}}, "cveMetadata": {"cveId": "CVE-2026-78166", "state": "PUBLISHED", "dateUpdated": "2026-08-26T18:10:41.209Z", "dateReserved": "2026-08-23T13:57:16.161Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-24T01:00:11.519Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:provectus:kafka-ui:*:*:*:*:*:*:*:*"], "modules": ["Groovy Code Handler"], "product": "kafka-ui", "vendor": "provectus", "versions": [{"status": "affected", "version": "0.7.0"}, {"status": "affected", "version": "0.7.1"}, {"status": "affected", "version": "0.7.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "id": "CVE-2026-78166", "lastModified": "2026-08-26T19:17:08.070", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78166", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T18:10:28.887286Z", "version": "2.0.3"}}]}, "published": "2026-08-24T02:17:04.120", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/provectus/kafka-ui/"}, {"source": "cna@vuldb.com", "url": "https://github.com/provectus/kafka-ui/issues/4567"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-78166"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/883727"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394555"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/394555/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "kafka-ui", "source": "cna", "vendor": "provectus"}, "product": "kafka-ui", "vendor": "provectus"}], "created": "2026-08-24T02:30:10.674435+00:00", "updated": "2026-08-24T02:30:10.781112+00:00", "vendors": ["provectus", "provectus$PRODUCT$kafka-ui"]}