Apache Kafka vulnerabilities

• apache apache-airflow-providers-apache-kafka, apache software foundation airflow apache kafka provider +1 more Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration CVE-2026-86792 Fix available 8.8 HighSeptember 16, 2026
• apache kafka Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API CVE-2026-41115 Fix available 4.3 MediumJune 2, 2026
• apache kafka, red hat openshift serverless, build of apache camel 4 for quarkus 3 +16 more +18 more Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVE-2026-33557 Fix available 9.1 CriticalApril 20, 2026
• apache kafka, apache software foundation kafka clients +1 more Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output CVE-2026-33558 Fix available 5.3 MediumApril 20, 2026
• apache kafka, apache software foundation kafka clients +1 more Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition CVE-2026-35554 Fix available 8.7 HighApril 7, 2026
• apache kafka, apache software foundation kafka client +1 more Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVE-2025-27817 Public exploitFix available EPSS 69.8% 7.5 HighJune 10, 2025
• apache kafka Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVE-2025-27819 Fix available 7.5 HighJune 10, 2025
• apache kafka Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVE-2025-27818 Fix available 8.8 HighJune 10, 2025
• apache kafka Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption CVE-2024-56128 Fix available 5.3 MediumDecember 18, 2024
• apache kafka, apache software foundation kafka clients +1 more Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider CVE-2024-31141 Fix available 6.5 MediumNovember 19, 2024
• apache kafka Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode CVE-2024-27309 Fix available 7.4 HighApril 12, 2024
• apache kafka connect, apache software foundation kafka connect api +1 more Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect CVE-2023-25194 Public exploitFix available EPSS 95.8% 8.8 HighFebruary 7, 2023
• apache kafka Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVE-2022-34917 Fix available 7.5 HighSeptember 20, 2022
• apache kafka, oracle communications brm - elastic charging engine, communications cloud native core policy +5 more +7 more Timing Attack Vulnerability for Apache Kafka Connect and Clients CVE-2021-38153 Fix available 5.9 MediumSeptember 22, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache kafka +15 more +17 more Buffer not correctly recycled in Gzip Request inflation CVE-2020-27218 Fix available 4.8 MediumNovember 28, 2020
• apache kafka, oracle banking corporate lending process management, banking credit facilities process management +10 more +12 more Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka CVE-2019-12399 Fix available 7.5 HighJanuary 14, 2020
• apache kafka Improper Input Validation in Apache Kafka CVE-2018-17196 Fix available 8.8 HighJuly 11, 2019
• apache kafka, oracle database, primavera p6 enterprise project portfolio management +2 more +4 more Improper Control of Generation of Code in Apache Kafka CVE-2018-1288 Fix available 5.4 MediumJuly 26, 2018
• apache kafka Improper Authentication in Apache Kafka CVE-2017-12610 Fix available 6.8 MediumJuly 26, 2018