KA
Product
Kafka
17
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 8Medium 8Low 0
Watch
Add Kafka to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33557 | 9.1 | Apr 20 | Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication Affected: 4.1.0 before 4.1.2 |
| CVE-2025-27818 | 8.8 | Jun 10 | A possible security vulnerability has been identified in Apache Kafka Affected: 2.3.0 before 3.9.1 |
| CVE-2018-17196 | 8.8 | Jul 11 | In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation Affected: 0.11.0.0 through 2.1.0 |
| CVE-2026-35554 | 8.7 | Apr 7 | Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition Affected: 2.8.0 before 3.9.2; 4.0.0 before 4.0.2; 4.1.0 before 4.1.2 |
| CVE-2025-27819 | 7.5 | Jun 10 | In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API Affected: 2.0.0 through 3.3.2 |
| CVE-2025-27817 | 7.5 | Jun 10 | A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client Affected: 3.1.0 before 3.9.1 |
| CVE-2022-34917 | 7.5 | Sep 20 | A security vulnerability has been identified in Apache Kafka Affected: 2.8.0 before 2.8.2; 3.0.0 before 3.0.2; 3.1.0 before 3.1.2; 3.2.0 before 3.2.3 |
| CVE-2019-12399 | 7.5 | Jan 14 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on… Affected: 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.2.0; 2.2.1; +1 more |
| CVE-2024-27309 | 7.4 | Apr 12 | While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced Affected: 3.5.0 through 3.6.1 |
| CVE-2017-12610 | 6.8 | Jul 26 | In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or… Affected: 0.10.0.0 through 0.10.2.1; 0.11.0.0 through 0.11.0.1 |
| CVE-2024-31141 | 6.5 | Nov 19 | Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients Affected: 2.3.0 through 3.5.2; 3.6.0 through 3.6.2; 3.7.0 |
| CVE-2021-38153 | 5.9 | Sep 22 | Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more… Affected: 2.0.0 before 2.6.3; 2.7.0 before 2.7.2; 2.8.0 |
| CVE-2018-1288 | 5.4 | Jul 26 | In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually… Affected: after 0.9.0.0 through 0.9.0.1; 0.10.0.0 through 0.10.2.1; 0.11.0.0 through 0.11.0.2; 1.0.0 |
| CVE-2026-33558 | 5.3 | Apr 20 | Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output Affected: 0.11.0.0 before 3.9.2; 4.0.0; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2024-56128 | 5.3 | Dec 18 | Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption Affected: 0.10.2.0 before 3.7.2; 3.8.0 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 2.7.0 |
| CVE-2026-41115 | 4.3 | Jun 2 | Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API Affected: 4.0.0 through 4.3.0 |
Showing 17