CVE-2018-1288

CVE-2018-1288: vulnerability in Apache Kafka

Published · Updated

Follow this CVE+ Monitor Apache Kafka+ Monitor org.apache.kafka:kafka

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 4.8%
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
Affected products
Apache Software Foundation · Apache Kafka
Related CVEs — Apache Kafka

In the same product, most dangerous first.

CVE-2021-38153—Timing Attack Vulnerability for Apache Kafka Connect and ClientsEPSS 6.2%CVE-2017-12610—CVE-2017-12610EPSS 2.9%CVE-2022-34917HIGHUnauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersEPSS 1.5%CVE-2024-27309HIGHApache Kafka: Potential incorrect access control during migration from ZK mode to KRaft modeEPSS 1.1%CVE-2025-27818HIGHApache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configurationEPSS 1.1%CVE-2025-27819HIGHApache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configurationEPSS 1.0%