UpHeron
All vulnerabilities

Servers and applications

CVE-2024-27309

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met,…

Severity
High 7.4
Published
12 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache KafkaServers and applications · cpe:a:apache:kafka
  • From 3.5.0 up to 3.6.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-27309
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-27309