Improper input validation in Apache Kafka
Priority MEDIUM 46CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.
Why it matters now
EPSS 0.05379 92nd percentileScored 2026-11-07
Fix Partial org.apache.kafka:kafka (Maven): 2.1.1Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Kafka | 0.11.0.0 to 2.1.0 | — | No fix listed | CNA |
| — | org.apache.kafka:kafka (Maven) | 0.11.0.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-47w3-66wq-cpxg |
- Kafka VendorApache Affected 0.11.0.0 to 2.1.0 Fixed in — No fix listed CNA
- org.apache.kafka:kafka (Maven) Vendor— Affected 0.11.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-47w3-66wq-cpxg
Remediation
- Fix · GHSA-47w3-66wq-cpxg org.apache.kafka:kafka (Maven) Fixed in 2.1.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Mobile Application Platform 4 | Affected | No fix planned: Out of support scope |
Not affected: 4 products
- Red Hat Fuse 7
- Red Hat JBoss Fuse 6
- Red Hat OpenShift Application Runtimes
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2018-17196
- 2026-10-03 Alias added: GHSA-47w3-66wq-cpxg
References
Other 17
- [kafka-commits] 20190802 [kafka-site] branch asf-site updated: Add CVE-2018-17196, fix some links. (#223)
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [kafka-commits] 20200115 [kafka-site] branch asf-site updated: Add CVE-2019-12399 (#250)
- [druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.mail-archive.com/dev%40kafka.apache.org/msg99277.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [flink-user] 20210703 Re: owasp-dependency-check is flagging flink 1.13 for scala 2.12.7
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/d1581fb6464c9bec8a72575c01f5097d68e2fbb230aff24622622a58@%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rc27d424d0bdeaf31081c3e246db3c66e882243ae3f342dfa845e0261@%3Ccommits.kafka.apache.org%3E
- https://www.mail-archive.com/[email protected]/msg99277.html
More Apache Kafka vulnerabilities
- TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
- TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
- TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
- TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
- TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5
- TI-2019-09246 Cleartext transmission of sensitive information in Apache Kafka CVSS 3.1HIGH 7.5
Sources
- CVE-2018-17196 · CVE Program
- CVE-2018-17196 · NVD
- FIRST EPSS
- GHSA-47w3-66wq-cpxg · GitHub Advisory Database · CC BY 4.0
- CVE-2018-17196 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences