CVE-2024-56128

Apache Kafka's SCRAM implementation fails to adhere to RFC 5802 because it does not verify that the nonce sent by the client in the second message matches the server's nonce from the first message. This vulnerability is exploitable only if an attacker has plaintext access to the SCRAM authenticat...

CVE-2020-27218

CVE-2020-27218 affects Eclipse Jetty 9.4.x (9.4.0.RC0–9.4.34.v20201102), 10.x (10.0.0.alpha0–beta2), and 11.x (11.0.0.alpha0–beta2). When GZIP request body inflation is enabled and requests from different clients are multiplexed on one connection, an attacker who can send a body that is received ...

CVE-2026-41115

Apache Kafka contains an improper authorization vulnerability (CWE-285) in the CONSUMER_GROUP_DESCRIBE (69) API. The discrepancy exists because the API validates the DESCRIBE operation on the GROUP resource, while official documentation and KIP-848 specify READ . While the current implementation ...

CVE-2024-31141

Apache Kafka Clients (versions 2.3.0 through 3.5.2, 3.6.2, and 3.7.0) are vulnerable to an improper privilege management flaw where attackers can read arbitrary disk contents or environment variables. The root cause lies in the ConfigProvider plugins, specifically the FileConfigProvider , Directo...

CVE-2025-27817

A vulnerability in the Apache Kafka Client allows for arbitrary file read and Server-Side Request Forgery (SSRF) due to insufficient validation of configuration data. Attackers who can specify client configurations can exploit the sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endp...

CVE-2021-38153

Apache Kafka is vulnerable to a timing attack due to the use of the Arrays.equals component to validate passwords or keys. This flaw allows a malicious actor to perform brute-force attacks to obtain authentication credentials and potentially elevate system privileges. Affected versions include Ap...

CVE-2024-27309

Apache Kafka is vulnerable to improper access control during migration from ZooKeeper mode to KRaft mode . If an administrator removes an ACL from a resource that retains two or more other ACLs, Kafka incorrectly treats the resource as having only one ACL. This can lead to denial of service (if o...

CVE-2022-34917

Apache Kafka (CVE-2022-34917) is vulnerable to denial of service due to a memory allocation issue on brokers triggered by malicious unauthenticated clients. Affected releases start from 2.8.0 onward, with scenarios including clusters without authentication, with SASL, or with TLS (TLS requires su...

CVE-2025-27818

A security vulnerability exists in Apache Kafka that allows an authenticated operator to trigger unrestricted deserialization of untrusted data, potentially leading to Remote Code Execution (RCE) . By using alterConfig or the Kafka Connect REST API, an attacker can set the sasl.jaas.config proper...

CVE-2018-17196

CVE-2018-17196 (Apache Kafka) : A vulnerability in Kafka versions 0.11.0.0–2.1.0 allows a remote authenticated attacker to bypass transaction/idempotent ACL validation by crafting a Produce request. The issue stems from improper input validation, requiring authenticated clients with Write permiss...

CVE-2026-33558

An information exposure vulnerability exists in the Apache Kafka NetworkClient component. When the log level is set to DEBUG (the default is INFO), the component outputs entire request and response information into the logs. Impacted APIs include AlterConfigsRequest, AlterUserScramCredentialsRequ...

CVE-2019-12399

CVE-2019-12399 affects Apache Kafka Connect: when Connect workers are configured with config providers and a connector uses an externalized secret variable within a substring of a configuration value, an attacker can request a cluster’s task configuration and receive the plaintext secret instead ...

CVE-2025-27819

Apache Kafka brokers are vulnerable to a Remote Code Execution (RCE) and Denial of Service (DoS) attack via the SASL JAAS JndiLoginModule configuration. This vulnerability arises from the deserialization of untrusted data (CWE-502) when an attacker with AlterConfigs permission on the cluster reso...

CVE-2026-33557

A security vulnerability exists in Apache Kafka due to the default configuration of the sasl.oauthbearer.jwt.validator.class property, which is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. This validator fails to verify the signature, issuer, or audience of JWT tokens....

CVE-2026-35554

A race condition exists in the Apache Kafka Java producer client buffer pool management. When a production batch expires due to delivery.timeout.ms while a network request is still in flight, its ByteBuffer is prematurely deallocated and returned to the pool. A subsequent batch may reuse this buf...

CVE-2018-1288

CVE-2018-1288 affects Apache Kafka across multiple 0.9.x–1.0.0 release lines; authenticated users can issue a fetch request that performs a broker-reserved action, potentially causing data loss during replication. Public documentation here documents the issue and confirms fixes in later Kafka bui...

CVE-2017-12610

CVE-2017-12610 affects Apache Kafka versions 0.10.0.0–0.10.2.1 and 0.11.0.0–0.11.0.1. The issue allows an authenticated Kafka client to impersonate other users by sending a manually crafted protocol message when SASL/PLAIN or SASL/SCRAM is used against the built-in servers. The vulnerability can ...