TI-2024-18147 Aliases CVE-2024-27309 GHSA-79vv-vp32-gpp7

Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode

LOW 37CWE-863Published 2024-04-12 · Updated 2025-07-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain). The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01125 66th percentileScored 2026-11-07

Fix Partial org.apache.kafka:kafka-metadata (Maven): 3.6.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Kafka	3.5.0 – 3.5.2; 3.6.0 – 3.6.1	—	No fix listed	CNA
—	org.apache.kafka:kafka-metadata (Maven)	3.5.0 to before 3.6.2	3.6.2	Patch available	GHSA-79vv-vp32-gpp7

Apache Kafka VendorApache Affected 3.5.0 – 3.5.2; 3.6.0 – 3.6.1 Fixed in — No fix listed CNA
org.apache.kafka:kafka-metadata (Maven) Vendor— Affected 3.5.0 to before 3.6.2 Fixed in 3.6.2 Patch available GHSA-79vv-vp32-gpp7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:kafka::::::::	3.5.0 – 3.6.1	Vulnerable	Apache

cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* Versions 3.5.0 – 3.6.1 Vulnerable ·Apache

Remediation

Fix · GHSA-79vv-vp32-gpp7 org.apache.kafka:kafka-metadata (Maven) Fixed in 3.6.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
streams for Apache Kafka	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2024-27309
2026-10-03 Alias added: GHSA-79vv-vp32-gpp7

References

Advisory 4

Other 3

TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences