Summary: 

In streams mode the management API binds to all interfaces on port 4195 with authentication disabled by default. Anyone who can reach that port can create a stream, and because pipeline configs can contain command-executing processors, that means arbitrary command execution as the Connect service account. Reporter confirmed it on v4.105.0 and v4.109.0 and believes all 4.x in streams mode are affected. The auth machinery already exists in the API config, it is just off by default and listening everywhere, so this is primarily an insecure-default problem rather than a missing capability. The affected code is in the community/OSS path, across both benthos and connect, so the fix has to land there.

This is fixed in Redpanda Connect version 4.111 which makes the API endpoint opt-in vs the current opt-out. 

Self-hosted and Community customers only and only if they are using streams mode API. No pipelines will stop or fail, they just won't be able to control their pipelines via API without setting the opt-in flag

Severity: 

High

Redpanda Products Affected:

• Redpanda Connect Self-Managed - Enterprise

• Redpanda Connect Self-Managed - Community

Release Affected: 

Connect / Benthos versions < 4.111

Identification: 

Streams Mode with no authentication setup for API endpoint and users that use the dynamic input

Impact: 

OSS and Self-Hosted customers that are running Streams mode and have not set up the optional authentication for the management API are at risk to someone running code in their environment. If an outside actor gained access to the API port, they would be able to run pipelines that include components like subprocess that allows custom code to be run.

Action required: 

If you:

• Run Connect in Streams Mode and create, update, remove or inspect streams over its REST API.

• You use the dynamic input or output and add, change or remove components over its REST API.

What you need to do

1. Streams Mode users: restart Connect with the --bind-http flag: 

   1. rpk connect streams --bind-http [your existing arguments]

   2. This turns back on the endpoints under /streams and /resources/{type}/{id}.

2. Dynamic input/output users: set bind_http: true on each dynamic component you manage at runtime, then restart Connect:

   1. input:

  dynamic:

    bind_http: true

    inputs: {}

output:

  dynamic:

    bind_http: true

    outputs: {}

This turns back on the /inputs and /outputs endpoints.

What is not affected

These endpoints work as before with no change needed: /ping, /ready, /stats, /metrics, and any endpoints served by http_server components.

Note: The --no-api flag is deprecated and no longer does anything. The API is now off unless you pass --bind-http. You can remove --no-api from your startup commands. If you leave it in, Connect only logs a warning.

Questions? If you have any questions on this TSB, or need further guidance, please contact Redpanda Support