CVE-2026-123270

What it is. Redpanda Connect is a data streaming and pipeline tool from Redpanda Data, formerly called Benthos. In streams mode it runs a management HTTP API. In affected releases that API listens on all interfaces on port 4195, and authentication is off by default. The CVE record describes this as CWE-306, Missing Authentication for Critical Function, and says it can lead to full host compromise, credential theft and data exfiltration, with no user interaction or credentials required.

Redpanda Connect 4.111.0 changed the default. The streams management endpoints are no longer registered unless the operator sets the new --bind-http flag. The change came from a Benthos code change that made the API opt-in, and the 4.111.0 release notes do not mention it. The CVE record and the reporter both say the same issue remains reachable on 4.111 and later when --bind-http is set. The reporter verified this on 4.116.1 and 4.117.0 with the API enabled and neither http.basic_auth nor a trusted http.address configured.

Affected versions. The CVE record lists 4.39 through 4.110. The reporter tested every stable release from 4.39.0 onward and says the insecure default predates that range, so treat older 4.x streams-mode deployments as in scope too.

Not to be confused with. CVE-2026-82266, which affects the Admin API of the Redpanda broker. Fixing one does not fix the other.

Checks. Run these only on systems your organization owns.

1. Which version is running? Record the Redpanda Connect release on every host, container image and package. Anything at 4.110 or older needs the checks below. After an upgrade, confirm the new build is the one running.
2. Is streams mode in use? Check how each instance starts. The management API in this CVE belongs to streams mode.
3. Is --bind-http set? On 4.111 and later, check start scripts, service units, container commands and Helm values for the flag. Without it, the streams management endpoints are not registered.
4. Is http.basic_auth configured? Check the http section of the config. Redpanda's documentation shows basic_auth disabled by default.
5. Where does http.address bind? Redpanda's documentation shows a default of 0.0.0.0:4195, which means all interfaces. A loopback or management-only address narrows who can reach the API.
6. Can an untrusted network reach the listener? Using authorized scans from the networks you care about, check whether TCP 4195, or the configured listen address, answers. Include internal segments, since the CVE only requires network access.
7. What can the service account reach? Code runs with the permissions of the Redpanda Connect service account. Inventory that account's privileges and the secrets available to the process, such as Kafka credentials, cloud storage keys and connection strings.

If any one condition is missing, such as a fixed release with the API unbound, or an API that only trusted hosts can reach with authentication on, the path is closed for that instance at the time you checked.

The CVE record lists no workaround. Upgrading to 4.111.0 or later is the vendor fix, and leaving --bind-http unset keeps the streams management API off.

• If you enable the API, protect it. The Benthos code change that made the API opt-in says to secure the server by binding http.address to a trusted interface, configuring http.basic_auth, or both. This only helps if every instance that runs with --bind-http has the setting, and you confirm from an untrusted network position that the API refuses requests without credentials.

Neither the CVE record nor the reporter's advisory publishes indicators of compromise. General signals to review are below.

• Startup logs showing the Connect HTTP listener bound to all interfaces on port 4195 on hosts where you did not intend that exposure.
• Network logs showing connections to the management port from sources outside your operator networks.
• Process activity from the Redpanda Connect service account that your pipelines do not explain, such as unexpected child processes or outbound connections.

Am I exposed to CVE-2026-123270?

You may be if you run Redpanda Connect 4.110 or older in streams mode, or 4.111 or later with --bind-http, and the management API is reachable from a network you do not trust without basic auth. Check the version, startup flags, the http.basic_auth and http.address settings, and whether TCP 4195 is reachable.

Is CVE-2026-123270 being exploited?

No exploitation has been reported. CISA ADP records exploitation as none, the reporter calls in-the-wild use not observed, and it is not on CISA KEV as of the November 9, 2026 catalog. Public exploit code has existed since November 9.

Is there a patch for CVE-2026-123270?

Yes. Redpanda says the issue is fixed in Redpanda Connect 4.111, which makes the management API opt-in. Upgrade to 4.111.0 or later and leave --bind-http unset unless you need the API.

How do I reduce risk without upgrading today?

The CVE record lists no workaround. Upgrading is the fix. If you run the API, configure http.basic_auth and bind http.address to a trusted interface, per the Benthos code change, and test it before relying on it.

Does the 4.111 default-off setting still protect me if I re-enable the API?

No. The CVE record says the issue remains reachable on 4.111 and later when the management API is enabled with --bind-http. If you need the API, configure http.basic_auth and bind http.address to a trusted interface.

Nov 9, 2026. First published. Public exploit code since November 9; CISA ADP scores it 9.8 and records exploitation as none; not on CISA KEV.

• CVE-2026-123270 record (CNA CERT/CC, with CISA ADP Vulnrichment)
• GitHub Advisory GHSA-h882-2qpw-598h (unreviewed)
• NIST NVD: CVE-2026-123270 (Received, checked Nov 9)
• Reporter advisory and public exploit repository by Adrian Pastor, including the vendor statement provided through CERT/CC (read only, not run)
• Benthos change making the streams management API opt-in
• Redpanda Connect v4.111.0 release (Sept 25, 2026)
• Redpanda Connect HTTP server documentation
• CISA Known Exploited Vulnerabilities catalog (checked catalog version 2026.11.09)