Read the docs
TI-2026-29745 Aliases CVE-2026-41115GHSA-p5r3-m3w4-4fj6

Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API

Priority LOW 20CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-285.

Summary

An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Kafka4.0.0 – 4.3.0—No fix listedCNA
  • Apache Kafka VendorApache Affected 4.0.0 – 4.3.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*4.0.0 – 4.3.0VulnerableApache
  • cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* Versions 4.0.0 – 4.3.0 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred
Red Hat build of Debezium 3AffectedNo fix yet: Fix deferred
Red Hat build of QuarkusAffectedNo fix yet: Fix deferred
Not affected: 5 products
  • OpenShift Serverless
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41115
  2. 2026-10-03 Alias added: GHSA-p5r3-m3w4-4fj6

References

Advisory 2

  • TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
  • TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
  • TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
  • TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
  • TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences