Not rated
CVE-2018-1288 In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may…
Description
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Kafka | 1.0.0 | No fix stated |
References
- [kafka-users] 20180726 CVE-2018-1288: Authenticated Kafka clients may interfere with data replication lists.apache.org
- 104900 www.securityfocus.com
- RHSA-2018:3768 access.redhat.com
- [kafka-commits] 20190802 [kafka-site] branch asf-site updated: Add CVE-2018-17196, fix some links. (#223) lists.apache.org
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities lists.apache.org
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [flink-issues] 20200402 [GitHub] [flink] zentol opened a new pull request #11617: [FLINK-16389][kafka] Bump kafka version to 0.10.2.2 lists.apache.org
- www.oracle.com www.oracle.com
- [kafka-dev] 20211007 Re: CVE Back Port? lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Kafka
The 23 CVEs of Apache Kafka →
CVE-2026-114349
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Not rated
CVE-2026-112375
Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
Not rated
CVE-2026-116593
Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
Not rated
CVE-2026-115644
Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
Not rated