UpHeron
All vulnerabilities

Servers and applications

CVE-2025-27818

A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0). When…

Severity
High 8.8
Published
10 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.9.1
Sources
NVD

Affected software

SoftwareAffected versions
Apache KafkaServers and applications · cpe:a:apache:kafka
  • From 2.3.0 before 3.9.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-27818
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-27818