EUVD-2026-81041

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

CVE-2026-92778

CMAK (Yahoo's Cloud Management for Apache Kafka) through 3.0.0.6 contains a feature gate bypass in its HTML form routes. The scheduled leader election feature toggle is not applied to these routes, allowing an authenticated low-privilege attacker to access form endpoints and start or stop the rec...

CVE-2023-34040

CVE-2023-34040 此PoC克隆自 https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040 关于我们的分析过程，请访问主仓库中的PDF文件。...

CVE-2025-27817

免责申明： 本文所描述的漏洞及其复现步骤仅供网络安全研究与教育目的使用。任何人不得将本文提供的信息用于非法目的或未经授权的系统测试。作者不对任何由于使用本文信息而导致的直接或间接损害承担责任。如涉及侵权，请及时与我们联系，我们将尽快处理并删除相关内容。 博客地址： https://blog.csdn.net/xc214/article/details/148698902?spm=1001.2014.3001.5501 纷传地址： 25hvv poc实时更新中 https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X...

kcatcher

捕捉潜藏在你的 Kafka 集群中的一切。 简介 Kcatcher 是一款用于枚举和评估 Kafka 集群配置的命令行工具。它可以连接 Apache Kafka 集群，检索有关 broker、主题、ACL 甚至消息样本的详细信息。非常适合安全审计、基础设施评估，或只是想了解 Kafka 环境中运行了什么。 演示 安装 Go 如果你有一个可用的 Go 环境，可以通过以下命令安装： root@kitploit: go install github.com/RoseSecurity/kcatcher@latest Apt 要安装软件包，你可以自动快速设置仓库： root@kitploit:...

Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

CVE-2026-86792

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

EUVD-2026-80321

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings in a Kafka connection's extra field into Python callables via import_string with no allowlist , handing them to the confluent-kafka client. When the Kafka event producer is enabled (dag_run_events_enable...

kafka-keycloak-oauth

Apache Kafka 4.1.0 与 Keycloak OAuth2 认证 生产就绪的 Apache Kafka 4.1.0（KRaft 模式），使用 Strimzi Kafka 镜像实现 Keycloak 26.1.1 OAuth2/OIDC 认证。 为什么选择本项目 vs kafka-oauth-keycloak-tls-demo 这是之前 POC 的演进 版本，具有显著改进： Strimzi OAuth 0.17.0 （对比 1.0.0）- 随 Strimzi Kafka 0.48.0 镜像捆绑的稳定生产版本 无需自定义 Docker 构建 - 使用预装 OAuth 的官方...

Spring-Kafka-POC-CVE-2023-34040

Spring Kafka Deserialización POC Requisitos Java 11 Maven Docker o Kafka Uso Primero inicia la instancia Kafka dockerizada. Esto arrancará Kafka y lo dejará disponible en el puerto 29092. root@kitploit: docker-compose up Inicia la aplicación consumidora. root@kitploit: cd spring-kafka-consumer mv...

CVE-2023-52251-POC

CVE-2023-52251-POC 存在一个远程代码执行漏洞，影响 provectus/kafka-ui。截至撰写本文时，尚无补丁，但我们已经通知了厂商以及 VINCE 团队，未收到任何回应。报告已于 2023 年 9 月 27 日通过电子邮件和 GitHub Security 发送给 provectus。 修复方案 我们建议至少将整个 groovy 过滤器函数注释掉/添加身份验证。 元数据...

cve-2023-34040

CVE-2023-34040 Spring Kafka 反序列化远程代码执行 root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36 Accept:...

CVE-2023-34040

CVE-2023-34040 Ejecución remota de código por deserialización en Spring Kafka root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko...

CVE-2026-55225

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

cve-2023-25194

Apache Druid CVE-2023-25194 CVE-2023-25194 是一个影响 Apache Kafka 的反序列化漏洞。该 go-exploit 演示了如何利用 CVE-2023-25194 攻击 Apache Druid（通过 Kafka）。此类攻击通常需要 LDAP JNDI 攻击者基础设施，而这种基础设施通常分散在多个工具中。然而，所有这些都已内置于该 go-exploit 中，以便于利用。 编译 要将该漏洞利用程序构建为 docker 镜像，只需： root@kitploit: make docker 如果你手头有 Go 构建环境，也可以直接使用 make：...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...