CVE-2026-78166 provectus CVE debrief

Who should care

Defenders responsible for kafka-ui deployments should assess exposure and prioritize verification of the Groovy Code Handler. Operators, platform administrators, vulnerability managers, and security teams may be impacted by this vulnerability. They should review kafka-ui presence, assess Groovy Code Handler exposure, and monitor for potential remote attacks. Remediation priority is unknown due to limited vendor response.

Why it matters

CVE-2026-78166 is a code injection vulnerability in provectus kafka-ui up to 0.7.2. Defenders should prioritize verifying kafka-ui deployments and assessing Groovy Code Handler exposure to prevent potential remote attacks.

• Remote attackers may inject code through the Groovy Code Handler
• Defenders must verify kafka-ui presence and Groovy Code Handler exposure
• Remediation priority is unknown due to limited vendor response

Technical summary

The function executeSmartFilterTest in the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler is vulnerable to code injection, allowing remote attackers to inject code. The affected product is provectus kafka-ui up to 0.7.2. Defenders should prioritize verifying kafka-ui deployments and assessing Groovy Code Handler exposure to prevent potential remote attacks. The vulnerability is confirmed but vendor guidance is pending. kafka-ui deployments should be verified for exposure.

Defensive priority

Defenders should prioritize verifying the presence of kafka-ui in their environment and assessing the exposure of the Groovy Code Handler.

Recommended defensive actions

• Verify the presence of kafka-ui in the environment
• Assess the exposure of the Groovy Code Handler
• Monitor for potential remote attacks
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide information about the vulnerability, but the vendor's response and remediation status are unknown. Defenders should verify kafka-ui presence, assess Groovy Code Handler exposure, and monitor for potential remote attacks. Evidence is limited to CVE and NVD details. No additional information is available on exploitability or remediation status.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.