TI-2026-29745 CVE-2026-41115 · GHSA-p5r3-m3w4-4fj6
Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
Priority LOW 20
An improper authorization vulnerability has been identified in Apache Kafka.
Vulnerabilities
17 records
TI-2026-25947 CVE-2026-33557 · GHSA-28jg-cgg7-j4wc
Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
Priority MEDIUM 47
A possible security vulnerability has been identified in Apache Kafka.
TI-2026-25948 CVE-2026-33558 · GHSA-wf66-mphr-4c4r
Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
Priority LOW 31
Information exposure vulnerability has been identified in Apache Kafka.
TI-2026-27662 CVE-2026-35554 · GHSA-5qcv-4rpc-jp93
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Priority LOW 38
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.
TI-2025-20589 CVE-2025-27817 · GHSA-vgq5-3255-v292
Apache Kafka Client: Arbitrary file read and SSRF vulnerability
Priority HIGH 76
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client.
TI-2025-20591 CVE-2025-27819 · GHSA-mcwh-c9pg-xw43
Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration
Priority MEDIUM 41
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API.
TI-2025-20590 CVE-2025-27818 · GHSA-76qp-h5mr-frr4
Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration
Priority MEDIUM 42
A possible security vulnerability has been identified in Apache Kafka.
TI-2024-37123 CVE-2024-56128 · GHSA-p7c9-8xx8-h74f
Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
Priority LOW 26
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation.
TI-2024-20521 CVE-2024-31141 · GHSA-2x2g-32r7-p4x8
Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider
Priority LOW 32
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.
TI-2024-18147 CVE-2024-27309 · GHSA-79vv-vp32-gpp7
Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode
Priority LOW 37
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.
TI-2022-15706 CVE-2022-34917 · GHSA-c9h3-c6qj-hh7q
Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
Priority MEDIUM 42
A security vulnerability has been identified in Apache Kafka.
TI-2021-15833 CVE-2021-38153 · GHSA-3j6g-hxx5-3q26
Timing Attack Vulnerability for Apache Kafka Connect and Clients
Priority LOW 36
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.
TI-2020-16544 CVE-2020-27218 · GHSA-86wm-rrjm-8wh8
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2…
Priority LOW 33
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto…
TI-2019-09246 CVE-2019-12399 · GHSA-6jmf-mxwf-r3jc
Cleartext transmission of sensitive information in Apache Kafka
Priority LOW 39
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized…
TI-2018-12295 CVE-2018-17196 · GHSA-47w3-66wq-cpxg
Improper input validation in Apache Kafka
Priority MEDIUM 46
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation.
TI-2018-01193 CVE-2018-1288 · GHSA-gh27-38p5-mrxc
Code injection in Apache Kafka
Priority LOW 32
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data r…
TI-2017-09335 CVE-2017-12610 · GHSA-xm78-4m3g-7wm7
Improper authentication in Apache Kafka
Priority LOW 35
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-i…