Read the docs
TI-2025-20591 Aliases CVE-2025-27819GHSA-mcwh-c9pg-xw43

Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration

Priority MEDIUM 41CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01107 66th percentileScored 2026-11-07
Fix Fixed org.apache.kafka:kafka_2.12 (Maven): 3.4.0org.apache.kafka:kafka_2.13 (Maven): 3.4.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Kafka2.0.0 – 3.3.2—No fix listedCNA
—org.apache.kafka:kafka_2.10 (Maven)all versions—No fix listedGHSA-mcwh-c9pg-xw43
—org.apache.kafka:kafka_2.11 (Maven)all versions—No fix listedGHSA-mcwh-c9pg-xw43
—org.apache.kafka:kafka_2.12 (Maven)before 3.4.03.4.0Patch availableGHSA-mcwh-c9pg-xw43
—org.apache.kafka:kafka_2.13 (Maven)before 3.4.03.4.0Patch availableGHSA-mcwh-c9pg-xw43
—org.apache.kafka:kafka_2.8.0 (Maven)all versions—No fix listedGHSA-mcwh-c9pg-xw43
—org.apache.kafka:kafka_2.8.2 (Maven)all versions—No fix listedGHSA-mcwh-c9pg-xw43
—org.apache.kafka:kafka_2.9.1 (Maven)all versions—No fix listedGHSA-mcwh-c9pg-xw43
—org.apache.kafka:kafka_2.9.2 (Maven)all versions—No fix listedGHSA-mcwh-c9pg-xw43
  • Apache Kafka VendorApache Affected 2.0.0 – 3.3.2 Fixed in — No fix listed CNA
  • org.apache.kafka:kafka_2.10 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-mcwh-c9pg-xw43
  • org.apache.kafka:kafka_2.11 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-mcwh-c9pg-xw43
  • org.apache.kafka:kafka_2.12 (Maven) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-mcwh-c9pg-xw43
  • org.apache.kafka:kafka_2.13 (Maven) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-mcwh-c9pg-xw43
  • org.apache.kafka:kafka_2.8.0 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-mcwh-c9pg-xw43
  • org.apache.kafka:kafka_2.8.2 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-mcwh-c9pg-xw43
  • org.apache.kafka:kafka_2.9.1 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-mcwh-c9pg-xw43
  • org.apache.kafka:kafka_2.9.2 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-mcwh-c9pg-xw43

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*2.0.0 – 3.3.2VulnerableApache
  • cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* Versions 2.0.0 – 3.3.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-mcwh-c9pg-xw43 org.apache.kafka:kafka_2.12 (Maven) Fixed in 3.4.0 Advisory →
  • Fix · GHSA-mcwh-c9pg-xw43 org.apache.kafka:kafka_2.13 (Maven) Fixed in 3.4.0 Advisory →

Red Hat 1 advisory

  • RHSA-2025:23417 Released 2025-12-16 · Red Hat rating Important
    Streams for Apache Kafka 3.1.0 release and security update
    • Streams for Apache Kafka 3.1.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Streams for Apache Kafka 3.1.0Fixed RHSA-2025:23417
Not affected: 21 products
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Serverless
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Debezium 2
  • Red Hat build of Debezium 3
  • Red Hat build of Quarkus
  • streams for Apache Kafka
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27819
  2. 2026-10-03 Alias added: GHSA-mcwh-c9pg-xw43

References

Advisory 3

Other 1

  • TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
  • TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
  • TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
  • TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
  • TI-2019-09246 Cleartext transmission of sensitive information in Apache Kafka CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences