CLEANSTART-2026-TN31805 Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field

Security vulnerability affects the strimzi-kafka-operator package. Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

CVE-2025-27817

Disclaimer: The vulnerabilities and reproduction steps described in this document are for cybersecurity research and educational purposes only. No one may use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no liability for any...

kafka-keycloak-oauth

Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Production-ready Apache Kafka 4.1.0 KRaft mode with Keycloak 26.1.1 OAuth2/OIDC authentication using Strimzi Kafka image. Why This Project vs kafka-oauth-keycloak-tls-demo This is an evolution of the previous POC with significant improvements...

kafka-connect-filestream-win

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · kafka-connect-filestream-win Write-up: https://abraxaslabs.tech/research/kafka-connect-filestream-win kafka-connect-filestream-win Class: File write / unauth file read-write Windows CLASSPATH leftover Reach: Remote...

CVE-2026-83525

A flaw was found in Apache Kafka. An authenticated attacker with cluster administrative privileges can cause a Denial of Service DoS by sending a crafted snapshot request containing an empty topics array or a topic without partitions. Due to improper input handling in the FetchSnapshot Remote...

CVE-2026-114349

A flaw was found in Apache Kafka. An authenticated attacker with write permissions to a topic can cause a Denial of Service DoS by sending a specially crafted compressed record batch. Because the broker allocates memory based on an unvalidated record size declared in the decompressed data stream,...

CVE-2026-112375

A flaw was found in Apache Kafka. Broker configuration update requests are validated before authorization checks are performed, allowing arbitrary configuration providers to resolve variables and bypass security controls. An authenticated user without authorization privileges can exploit this fla...

CVE-2026-116593

A flaw was found in Apache Kafka Connect. This vulnerability allows information disclosure when a remote attacker accesses the connector configuration validation endpoint. By submitting a request to this endpoint, an attacker can force installed configuration providers to resolve and return...

CLEANSTART-2026-MK35077 race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

Security vulnerability affects the druid-fips package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...

CLEANSTART-2026-PE29721 race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

Security vulnerability affects the thingsboard package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...

CVE-2026-111115

A flaw was found in Apache Kafka. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request containing a large declared count of tagged fields in flexible request headers. Because the server does not adequately validate or limit this count against th...

CVE-2026-111551

A flaw was found in Apache Kafka. Several deserialization routines in the client and Streams libraries allocate memory directly based on an input's declared size field without validating whether enough data is actually available. An attacker who can send crafted messages to affected topics or...

CVE-2026-111108

A flaw was found in Apache Kafka. Due to improper input validation during protocol request parsing, the service pre-allocates disproportionately large memory collections based on the sender's declared array element count without verifying that the request buffer contains sufficient data. A remote...

CVE-2026-110985

A flaw was found in Apache Kafka. When configured to use token-based authentication without a remote key validation endpoint, the broker falls back to an internal validator that does not check JSON Web Token JWT signatures, algorithms, or issuers. An unauthenticated remote attacker can exploit th...

SUSE CVE-2026-33557

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...

CVE-2026-115644

A flaw was found in Apache Kafka Connect. When a dedicated network listener is configured for administrative services, configured security and authentication extensions are not applied to the administrative endpoints. An unauthenticated remote attacker with network access to this administrative...

CVE-2026-111073

A flaw was found in Apache Kafka. The broker-side telemetry interface validates only the compressed size of incoming metrics payloads, failing to enforce a limit on the decompressed data size. An authenticated client can exploit this flaw by sending a small, highly compressed payload that expands...

SUSE CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

SUSE CVE-2026-110985

A Kafka broker using SASL/OAUTHBEARER with the default validator sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset the default and...