CVE-2025-27818

🗓️ 10 Jun 2025 07:52:31Reported by apacheType

Security vulnerability in Apache Kafka allows RCE via malicious SASL JAAS LdapLoginModule configuration.

Reporter	Title	Published	Views	Family All 63
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in Apache kafka-client may affect IBM Business Automation Workflow - CVE-2025-27817, CVE-2025-27818	6 Nov 202510:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Kafka affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	25 Aug 202515:57	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	11 Sep 202518:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.	7 Oct 202507:40	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Kafka, IBM Operations Analytics - Log Analysis is affected by remote code execution and denial of service.	6 Jan 202615:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for Apache Flink	30 Dec 202513:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	13 Oct 202520:59	–	ibm
IBM Security Bulletins	Security Bulletin: Arbitrary File Read and SSRF via Unrestricted URL Configuration in Apache Kafka Client SASL/OAUTHBEARER Settings, affects watsonx.data	11 Sep 202508:52	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for December 2025.	23 Dec 202508:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Sept 2025 - Multiple CVEs addressed	28 Oct 202506:30	–	ibm

NVD

Vulners

Node

apache kafkaRange2.3.0–3.9.1

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Kafka",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "3.9.0",
        "status": "affected",
        "version": "2.3.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
kafka	www.kafka.apache.org/cve-list
openwall	www.openwall.com/lists/oss-security/2025/06/09/2

11 Jul 2025 16:54Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.8

EPSS0.00682

SSVC

CWE-502