Skip to content
Sign in
Not rated

CVE-2025-27819 In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka…

Description

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

Affected products and versions

Product Affected versions Fixed in
Apache Kafka 2.0 2.0.0 → 3.3.2 No fix stated

Other CVEs of Apache Kafka

The 23 CVEs of Apache Kafka →
CVE-2026-114349 Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches Not rated CVE-2026-112375 Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs Not rated CVE-2026-116593 Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint Not rated CVE-2026-115644 Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions Not rated
Track this CVE