Login Request a demo
KA
Product
Kafka
by Apache · last CVE Jun 2, 2026
17
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 1High 8Medium 8Low 0
Severity
All severities17Critical1High8Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Kafka to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-27818
8.8
1%
Jun 10
A possible security vulnerability has been identified in Apache Kafka
Affected: 2.3.0 before 3.9.1
CVE-2018-17196
8.8
5%
Jul 11
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation
Affected: 0.11.0.0 through 2.1.0
CVE-2026-35554
8.7
0%
Apr 7
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
Affected: 2.8.0 before 3.9.2; 4.0.0 before 4.0.2; 4.1.0 before 4.1.2
CVE-2025-27819
7.5
1%
Jun 10
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API
Affected: 2.0.0 through 3.3.2
CVE-2025-27817
7.5
69%
Jun 10
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client
Affected: 3.1.0 before 3.9.1
CVE-2022-34917
7.5
1%
Sep 20
A security vulnerability has been identified in Apache Kafka
Affected: 2.8.0 before 2.8.2; 3.0.0 before 3.0.2; 3.1.0 before 3.1.2; 3.2.0 before 3.2.3
CVE-2019-12399
7.5
4%
Jan 14
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on…
Affected: 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.2.0; 2.2.1; +1 more
CVE-2024-27309
7.4
1%
Apr 12
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced
Affected: 3.5.0 through 3.6.1
Showing 8