Apache Kafka vulnerabilities

17 CVEs affecting Apache Kafka, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41115, published 2026-06-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-27817, published 2025-06-10. High severity, CVSS 7.5. EPSS: 68.8% chance of exploitation in the next 30 days. A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the…
CVE-2020-27218, published 2020-11-28. Medium severity, CVSS 4.8. EPSS: 8.3% chance of exploitation in the next 30 days. In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients…
CVE-2021-38153, published 2021-09-22. Medium severity, CVSS 5.9. EPSS: 6.2% chance of exploitation in the next 30 days. Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be…
CVE-2018-17196, published 2019-07-11. High severity, CVSS 8.8. EPSS: 5.5% chance of exploitation in the next 30 days. In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write…
CVE-2018-1288, published 2018-07-26. Medium severity, CVSS 5.4. EPSS: 4.8% chance of exploitation in the next 30 days. In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request…
CVE-2019-12399, published 2020-01-14. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to…
CVE-2017-12610, published 2018-07-26. Medium severity, CVSS 6.8. EPSS: 2.9% chance of exploitation in the next 30 days. In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication…
CVE-2022-34917, published 2022-09-20. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on…
CVE-2024-31141, published 2024-11-19. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and…
CVE-2024-27309, published 2024-04-12. High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days. While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The…

Latest

CVE-2026-41115, published 2026-06-02. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead…
CVE-2026-33558, published 2026-04-20. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By…
CVE-2026-33557, published 2026-04-20. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to…
CVE-2026-35554, published 2026-04-07. High severity, CVSS 8.7. EPSS: 0.6% chance of exploitation in the next 30 days. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to…
CVE-2025-27819, published 2025-06-10. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the…
CVE-2025-27818, published 2025-06-10. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify…
CVE-2024-56128, published 2024-12-18. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism…