Deserialization in Kafbat Kafka-Ui

CVE-2025-49127

Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue.

Vulnerability class: Insecure Deserialization

EPSS: 0.005 (38.7th percentile) — read the EPSS interpretation.

Affected products

Kafbat Kafka-ui — versions = 1.0.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)