Apache Kafka (Apache Software Foundation) - vulnerabilities (CVEs)
23 CVEs, 12 in the last 30 days, 6 known versions, newest CVE from 2026-10-28. Vendor: Apache Software Foundation.
CVEs of Apache Kafka
- CVE-2026-114349, 2026-10-28: When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that…
- CVE-2026-112375, 2026-10-28: An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the…
- CVE-2026-116593, 2026-10-28: Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka…
- CVE-2026-115644, 2026-10-28: Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener…
- CVE-2026-111551, 2026-10-28: Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no…
- CVE-2026-111496, 2026-10-28: Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp +…
- CVE-2026-111115, 2026-10-28: Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for…
- CVE-2026-111108, 2026-10-28: Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only…
- CVE-2026-111073, 2026-10-28: The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before…
- CVE-2026-110985, 2026-10-28: A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation…
- CVE-2026-110952, 2026-10-28: A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further…
- CVE-2026-83525, 2026-10-28: Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an…
- CVE-2026-41115 - CVSS 4.3 (medium), 2026-06-02: An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE…
- CVE-2026-33558 - CVSS 5.3 (medium), 2026-04-20: Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in…
- CVE-2026-33557 - CVSS 9.1 (critical), 2026-04-20: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to…
- CVE-2025-27819 - CVSS 7.5 (high), 2025-06-10: In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect…
- CVE-2025-27818 - CVSS 8.8 (high), 2025-06-10: A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker,…
- CVE-2024-56128 - CVSS 5.3 (medium), 2024-12-18: Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted…
- CVE-2024-27309 - CVSS 7.4 (high), 2024-04-12: While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are…
- CVE-2022-34917 - CVSS 7.5 (high), 2022-09-20: A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients…
- CVE-2021-38153 - CVSS 5.9 (medium), 2021-09-22: Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for…
- CVE-2018-1288 - CVSS 5.4 (medium), 2018-07-26: In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the…
- CVE-2017-12610 - CVSS 6.8 (medium), 2018-07-26: In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with…
