CVE-2026-45080

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, improper access control allows disclosure of password hash. This issue has been patched in version 2.10.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Aiven-Open/klaw/releases/tag/v2.10.4
https://github.com/Aiven-Open/klaw/security/advisories/GHSA-v7m7-fr8v-hpx2

Configurations

No configuration.

History

22 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Klaw es una herramienta/portal de autogestión/gobernanza de temas de Apache Kafka. Antes de la versión 2.10.4, un control de acceso inadecuado permite la divulgación del hash de la contraseña. Este problema ha sido parcheado en la versión 2.10.4.

02 Jun 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-02 16:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-45080

Mitre link : CVE-2026-45080

CVE.ORG link : CVE-2026-45080

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-284

Improper Access Control

{"id": "CVE-2026-45080", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45080", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T16:39:43.546955Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Aiven-Open", "product": "klaw", "versions": [{"status": "affected", "version": "< 2.10.4"}]}]}], "published": "2026-06-02T16:16:41.390", "references": [{"url": "https://github.com/Aiven-Open/klaw/releases/tag/v2.10.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/Aiven-Open/klaw/security/advisories/GHSA-v7m7-fr8v-hpx2", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, improper access control allows disclosure of password hash. This issue has been patched in version 2.10.4."}, {"lang": "es", "value": "Klaw es una herramienta/portal de autogesti\u00f3n/gobernanza de temas de Apache Kafka. Antes de la versi\u00f3n 2.10.4, un control de acceso inadecuado permite la divulgaci\u00f3n del hash de la contrase\u00f1a. Este problema ha sido parcheado en la versi\u00f3n 2.10.4."}], "lastModified": "2026-07-22T19:10:00.120", "sourceIdentifier": "security-advisories@github.com"}