CVE-2026-44367 Details

A denial-of-service vulnerability has been identified in Klaw, a self-service Apache Kafka topic management tool, prior to version 2.10.4. The issue arises from inconsistent handling of username case sensitivity in the user registration and login processes. This discrepancy allows a malicious actor to register an account using a variation of an existing username's case, resulting in both accounts becoming completely inaccessible. The original and the case-variant accounts cannot be logged into, and this collision disrupts administrative tools, preventing the deletion of either account through the application interface.

Users are advised to upgrade to Klaw version 2.10.4 or later, where this vulnerability has been patched. For accounts already locked due to this issue, administrators must manually delete or rename the conflicting duplicate records at the database level, as the application's admin interface cannot process these deletions.