huttwothreefour/cve-2026-5562-exploitProof-of-concept exploit for CVE-2026-5562 targeting Kafka UI with automated reverse shell delivery via HTTP PUT request to the smartfilters API endpoint.
This repository contains a proof-of-concept research script for validating exposure in a controlled environment. It is only for research and education purpose, should not be used against production systems on which you do not have authorization.
Install the Python dependency from this directory:
python3 -m pip install -r requirements.txt
Display the built-in help without sending a request:
python3 exploit.py --help
| Option | Required | Description |
|---|
--url | Yes | Base URL of the Kafka UI instance, including http:// or https:// |
--ip | Yes | IP to receive reverse shell |
--port | No | Port to receive reverse shell, defaults to 12345 |
The script appends /api/smartfilters/testexecutions to the supplied base URL and issues an HTTP PUT request. Review the source and payload before any authorized execution.