Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Kafka nodes are vulnerable to privilege escalation [CVE-2024-31141]

Summary The Apache Kafka client is used by IBM App Connect Enterprise Certified Container for the Kafka client nodes. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run toolkit flows containing Kafka nodes are vulnerable to privilege...

SUSE CVE-2023-25194

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

CVE-2025-24970 vulnerabilities

Vulnerabilities for packages: zookeeper, thingsboard, druid, trino, apache-activemq-artemis, apicurio-registry, logstash, strimzi-kafka-operator, kafka, knative-kafka-broker, management-api-for-apache-cassandra-4.0, elasticsearch, opensearch, zookeeper-fips, celeborn, cloudwatch-exporter,...

CVE-2025-24970 vulnerabilities

Vulnerabilities for packages: docker-selenium, tez, wavefront-proxy, logstash, akhq, apicurio-registry, apache-pulsar, kserve-modelmesh, apache-activemq-artemis, trino, celeborn, management-api-for-apache-cassandra-5.0, keycloak, wildfly, opensearch, cloudwatch-exporter, selenium,...

GHSA-4G8C-WM8X-JFHW vulnerabilities

Vulnerabilities for packages: zookeeper, thingsboard, druid, trino, apache-activemq-artemis, apicurio-registry, logstash, strimzi-kafka-operator, kafka, knative-kafka-broker, management-api-for-apache-cassandra-4.0, elasticsearch, opensearch, zookeeper-fips, celeborn, cloudwatch-exporter,...

GHSA-4G8C-WM8X-JFHW vulnerabilities

Vulnerabilities for packages: docker-selenium, tez, wavefront-proxy, logstash, akhq, apicurio-registry, apache-pulsar, kserve-modelmesh, apache-activemq-artemis, trino, celeborn, management-api-for-apache-cassandra-5.0, keycloak, wildfly, opensearch, cloudwatch-exporter, selenium,...

Security Bulletin: Vulnerabilities in Apache Kafke affect watsonx.data

Summary Apache Kafka is vulnerable to denial of service attacks and to arbitrary code executed on the system attacks. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2022-34917 DESCRIPTION: Apache Kafka is vulnerable to a denial of service, caused by improper input validation. By...

Security Bulletin: Vulnerability in Apache Kafka affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential vulnerability in Apache Kafka has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Apache Kafka could allow...

CVE-2024-32030

Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying their network address and port. As a separate feature, it also provides the ability to monitor the performance of Kafka brokers by connecting to their JMX...

CVE-2024-37307

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.0 and prior to versions 1.13.7, 1.14.12, and 1.15.6, the output of cilium-bugtool can contain sensitive data when the tool is run with the --envoy-dump flag set against Cilium...

CVE-2024-4173

A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various attacks, including DOS against the Brocade SANnav...

Security Bulletin: IBM Sterling B2B Integrator is Vulnerable to Denial of Service due to Apache Kafka (CVE-2022-34917)

Summary IBM Sterling B2B Integrator has addressed the denail of service vulnerability from Apache Kafka Vulnerability Details CVEID:CVE-2022-34917 DESCRIPTION: Apache Kafka is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request, a remote...

GHSA-29QP-CRVH-W22M vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, velero-plugin-for-microsoft-azure, sftpgo-plugin-geoipfilter, crossplane-provider-aws-kms, crossplane-provider-azure-authorization, crossplane-provider-azure-storage, crossplane-provider-azure-managedidentity, vcluster,...

GHSA-29QP-CRVH-W22M vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, argo-rollouts, crossplane-provider-aws-lambda, sftpgo-plugin-geoipfilter, crossplane-provider-family-azure, sftpgo-plugin-eventsearch, crossplane-provider-azure-managedidentity, sftpgo-plugin-pubsub, argo-rollouts-fips,...

Security Bulletin: There is a vulnerability in kafka-clients-3.6.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2024-31141)

Summary There is a vulnerability in kafka-clients-3.6.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Apache Kafka could allow a local authenticated attacker to gain elevated privileges on the system, caused by a...

Security Bulletin: Apache Kafka vulnerability affect IBM Spectrum Control

Summary Apache Kafka vulnerable to local authenticated attacker to gain elevated privileges on the system affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Apache Kafka could allow a local authenticated attacker to gain elevated privileges on the system, caused ...

Incorrect Implementation Of The Authentication Algorithm

org.apache.kafka, kafka-clients is vulnerable to an incorrect implementation of the authentication algorithm. The vulnerability is due to the lack of nonce verification in Apache Kafka's SCRAM implementation, where the server does not verify that the nonce sent by the client in the second message...

The vulnerability of the Salted Challenge Response Authentication Mechanism (SCRAM) in Apache Kafka message dispatchers allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the Salted Challenge Response Authentication Mechanism SCRAM in Apache Kafka message brokers stems from the lack of verification of unique message IDs between the client and the server. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and...

BIT-KAFKA-2024-56128 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

SUSE CVE-2024-56128

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...