« Volver al listado

CVE-2026-44367

Estado: AplazadaBaja (2.7)—

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, a vulnerability exists in the user registration and login mechanisms due to inconsistent handling of username case sensitivity, leading to a targeted Denial of Service (DoS) and complete account lockout. This issue has been patched in version 2.10.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Aiven — KlawAIApache — KafkaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-44367",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44367",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T15:55:52.048254Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Aiven-Open",
          "product": "klaw",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.10.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T16:16:41.043",
  "references": [
    {
      "url": "https://github.com/Aiven-Open/klaw/releases/tag/v2.10.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Aiven-Open/klaw/security/advisories/GHSA-75rx-m9vh-mm9p",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-178"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, a vulnerability exists in the user registration and login mechanisms due to inconsistent handling of username case sensitivity, leading to a targeted Denial of Service (DoS) and complete account lockout. This issue has been patched in version 2.10.4."
    },
    {
      "lang": "es",
      "value": "Klaw es una herramienta/portal de autogestión/gobernanza de temas de Apache Kafka. Antes de la versión 2.10.4, existe una vulnerabilidad en los mecanismos de registro y de inicio de sesión de usuarios debido a un manejo inconsistente de la distinción entre mayúsculas y minúsculas en los nombres de usuario, lo que lleva a una denegación de servicio (DoS) dirigida y un bloqueo completo de la cuenta. Este problema ha sido parcheado en la versión 2.10.4."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "security-advisories@github.com"
}