CVE-2024-56128

Apache Kafka's SCRAM authentication implementation fails to comply with RFC 5802 because it does not verify that the client's second-message nonce matches the server's first-message nonce. This flaw allows an attacker with plaintext access to the authentication exchange to intercept and potential...

CVE-2020-27218

CVE-2020-27218 affects Eclipse Jetty 9.4.x (9.4.0.RC0–9.4.34.v20201102), 10.x (10.0.0.alpha0–beta2), and 11.x (11.0.0.alpha0–beta2). When GZIP request body inflation is enabled and requests from different clients are multiplexed on one connection, an attacker who can send a body that is received ...

CVE-2026-41115

Apache Kafka contains an improper authorization vulnerability (CWE-285) in the CONSUMER_GROUP_DESCRIBE (69) API. The discrepancy exists because the API validates the DESCRIBE operation on the GROUP resource, while official documentation and KIP-848 specify READ . While the current implementation ...

CVE-2024-31141

Apache Kafka Clients (versions 2.3.0 through 3.5.2, 3.6.2, and 3.7.0) are vulnerable to an improper privilege management flaw. The software includes ConfigProvider plugins, specifically FileConfigProvider , DirectoryConfigProvider , and EnvVarConfigProvider , which allow reading from the disk or ...

CVE-2025-27817

The Apache Kafka Client is vulnerable to arbitrary file read and Server-Side Request Forgery (SSRF) . The root cause is a lack of strict validation on the sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url configuration parameters. If these configurations are provided by a...

CVE-2021-38153

Apache Kafka is vulnerable to a timing attack due to the use of the Arrays.equals component to validate passwords or keys. This flaw allows a malicious actor to perform brute-force attacks to obtain authentication credentials and potentially elevate system privileges. Affected versions include Ap...

CVE-2024-27309

An authorization vulnerability exists in Apache Kafka during migration from ZooKeeper mode to KRaft mode . If an administrator removes an ACL from a resource that retains two or more other ACLs, Kafka incorrectly treats the resource as having only one associated ACL. This flaw can lead to availab...

CVE-2022-34917

Apache Kafka (CVE-2022-34917) is vulnerable to denial of service due to a memory allocation issue on brokers triggered by malicious unauthenticated clients. Affected releases start from 2.8.0 onward, with scenarios including clusters without authentication, with SASL, or with TLS (TLS requires su...

CVE-2025-27818

A security vulnerability in Apache Kafka allows an authenticated operator with access to alterConfig or the Kafka Connect REST API to inject an arbitrary SASL JAAS config . By setting the sasl.jaas.config property to com.sun.security.auth.module.LdapLoginModule via specific override properties, a...

CVE-2018-17196

CVE-2018-17196 (Apache Kafka) : A vulnerability in Kafka versions 0.11.0.0–2.1.0 allows a remote authenticated attacker to bypass transaction/idempotent ACL validation by crafting a Produce request. The issue stems from improper input validation, requiring authenticated clients with Write permiss...

CVE-2026-33558

An information exposure vulnerability exists in the Apache Kafka NetworkClient component. When the log level is set to DEBUG (the default is INFO), the component outputs entire request and response information into the logs. Impacted APIs include AlterConfigsRequest, AlterUserScramCredentialsRequ...

CVE-2019-12399

CVE-2019-12399 affects Apache Kafka Connect: when Connect workers are configured with config providers and a connector uses an externalized secret variable within a substring of a configuration value, an attacker can request a cluster’s task configuration and receive the plaintext secret instead ...

CVE-2025-27819

A flaw in the JndiLoginModule within the SASL authentication mechanism of Apache Kafka allows for Remote Code Execution (RCE) and Denial of Service (DoS) . An attacker with AlterConfigs permission on the cluster resource can provide a malicious JNDI URI within the broker's configuration to trigge...

CVE-2026-33557

A security vulnerability exists in Apache Kafka due to the default configuration of the sasl.oauthbearer.jwt.validator.class property, which is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. This validator fails to verify the signature, issuer, or audience of JWT tokens....

CVE-2026-35554

A race condition exists in the Apache Kafka Java producer client buffer pool management. When a production batch expires due to delivery.timeout.ms while a network request is still in flight, its ByteBuffer is prematurely deallocated and returned to the pool. A subsequent batch may reuse this buf...

CVE-2018-1288

CVE-2018-1288 affects Apache Kafka across multiple 0.9.x–1.0.0 release lines; authenticated users can issue a fetch request that performs a broker-reserved action, potentially causing data loss during replication. Public documentation here documents the issue and confirms fixes in later Kafka bui...

CVE-2017-12610

CVE-2017-12610 affects Apache Kafka versions 0.10.0.0–0.10.2.1 and 0.11.0.0–0.11.0.1. The issue allows an authenticated Kafka client to impersonate other users by sending a manually crafted protocol message when SASL/PLAIN or SASL/SCRAM is used against the built-in servers. The vulnerability can ...