CVE-2025-27817

Disclaimer: The vulnerabilities and reproduction steps described in this document are for cybersecurity research and educational purposes only. No one may use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no liability for any...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

kafka-keycloak-oauth

Apache Kafka 4.1.0 con autenticación OAuth2 de Keycloak Apache Kafka 4.1.0 listo para producción modo KRaft con autenticación OAuth2/OIDC de Keycloak 26.1.1 utilizando la imagen de Kafka de Strimzi. Por qué este proyecto vs kafka-oauth-keycloak-tls-demo Esta es una evolución del POC anterior con...

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

EUVD-2026-88379

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

PT-2026-99963

Name of the Vulnerable Software and Affected Versions StreamsHub Console for Apache Kafka affected versions not specified Description A flaw exists where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without...

CVE-2026-96740: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-59278

A flaw was found in Spring for Apache Kafka. The JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper components, which are used by default in @KafkaListener consumers, include java.net in their list of trusted packages. This allows a remote attacker, by sending a specially crafted message, to inje...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.6.0 Vulnerability Details CVEID:CVE-2026-59278 DESCRIPTION: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include...

CVE-2026-59317

A flaw was found in Spring for Apache Kafka. The DeadLetterPublishingRecovererFactory component does not properly validate the retrytopic-original-timestamp header. A remote attacker can exploit this by sending a specially crafted message with a malformed header, leading to an infinite processing...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview apache-airflow-providers-apache-kafka is a Provider package apache-airflow-providers-apache-kafka for Apache Airflow Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the importstring function. An...

CVE-2026-86792

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

EUVD-2026-80321

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792

The apache-airflow-providers-apache-kafka package (versions 1.15.0 before 2.0.0) is vulnerable to arbitrary code execution on the scheduler due to unsafe reflection. The root cause is the import_string function, which resolves dotted-path strings from a Kafka connection's extra field into Python ...