Posted by disclosure via Fulldisclosure on Aug 170day Rubbish Research Team is publicly disclosing a vulnerability in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.). The research is published and a proof-of-concept is available. Pre-authentication RCE (CVSS 9.8, pre-authentication) Confluent Platform 7.9.1-ce exposes an unauthenticated remote code execution chain in its default configuration. ksqlDB (HTTP 8089), the Kafka broker (9092 PLAINTEXT, no SASL) and Kafka Connect (8083) all...