ROOT-APP-MAVEN-CVE-2025-27817 CVE-2025-27817 in io.root.org.apache.kafka:kafka-clients - Patched by Root

Root has patched CVE-2025-27817 in the io.root.org.apache.kafka:kafka-clients package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerabilities in Apache Kafka Client affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Summary: Potential vulnerability in Apache Kafka Client has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-27817...

Security Bulletin: Security vulnerabilities in Apache kafka-client may affect IBM Business Automation Workflow - CVE-2025-27817, CVE-2025-27818

Summary IBM Business Automation Workflow packages a copy of Apache kafka-client with known vulnerabilities. Vulnerability Details CVEID:CVE-2025-27818 DESCRIPTION: A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource,...

Security Bulletin: There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Asset Management application (CVE-2025-27817,CVE-2025-27818)

Summary There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Asset Management application CVE-2025-27817,CVE-2025-27818 Vulnerability Details CVEID:CVE-2025-27817 DESCRIPTION: A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apach...

Security Bulletin: There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-27817)

Summary There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-27817 DESCRIPTION: A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka...

Exploit for Server-Side Request Forgery in Apache Kafka

Disclaimer: The vulnerabilities described in this article and...

Photon OS 5.0: Kafka PHSA-2025-5.0-0537

An update of the kafka package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0537. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: druid, debezium-connector-spanner, apicurio-registry, opensearch, wildfly, apache-nifi, strimzi-kafka-operator, thingsboard, logstash, zipkin...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: druid, opensearch, apicurio-registry, strimzi-kafka-operator, wildfly, logstash, apache-nifi, thingsboard, zipkin, debezium-connector-spanner...

CVE-2025-27817

A flaw was found in apache-kafka. The Kafka client improperly handles configuration data for SASL/OAUTHBEARER connections, allowing an attacker to specify a crafted token endpoint URL. This allows for arbitrary file reads and server-side request forgery SSRF by a malicious client. Consequently,...

ai.intelliswarm:swarmai-eval (>=1.0.6 <=1.0.28), ai.intelliswarm:swarmai-rag (=1.0.28) +3069 more potentially affected by CVE-2025-27817 via org.apache.kafka:kafka-clients (>=3.1.0 <=3.9.0)

org.apache.kafka:kafka-clients MAVEN version =3.1.0, =1.0.6, =1.0.6, =0.1, =3.0.1, =2.8.4-alpha2, =1.0.0, =1.0.0-beta, =0.0.1-alpha1, =0.0.1, =0.0.4, =0.1.0, =1.0.0.RELEASE, =1.0.2.RELEASE and more Source cves: CVE-2025-27817 Source advisory: SNYK:JAVA-ORGAPACHEKAFKA-10336719...

ai.intelliswarm:swarmai-eval (>=1.0.6 <=1.0.28), ai.intelliswarm:swarmai-rag (=1.0.28) +3069 more potentially affected by CVE-2025-27817 via org.apache.kafka:kafka-clients (>=3.1.0 <=3.9.0)

org.apache.kafka:kafka-clients MAVEN version =3.1.0, =1.0.6, =1.0.6, =0.1, =3.0.1, =2.8.4-alpha2, =1.0.0, =1.0.0-beta, =0.0.1-alpha1, =0.0.1, =0.0.4, =0.1.0, =1.0.0.RELEASE, =1.0.2.RELEASE and more Source cves: CVE-2025-27817 Source advisory: OSV:GHSA-VGQ5-3255-V292...

CVE-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url"...