CVE-2025-27819highCWE-502

CVE-2025-27819: high-severity vulnerability in Apache Kafka

Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration

Published

Follow this CVE+ Monitor Apache Kafka+ Monitor org.apache.kafka:kafka_2.11

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache Kafka
Related CVEs — Apache Kafka

In the same product, most dangerous first.

CVE-2021-38153—Timing Attack Vulnerability for Apache Kafka Connect and ClientsEPSS 6.2%CVE-2018-1288—CVE-2018-1288EPSS 4.8%CVE-2017-12610—CVE-2017-12610EPSS 2.9%CVE-2022-34917HIGHUnauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersEPSS 1.5%CVE-2024-27309HIGHApache Kafka: Potential incorrect access control during migration from ZK mode to KRaft modeEPSS 1.1%CVE-2025-27818HIGHApache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configurationEPSS 1.1%