CVE-2025-27817 Apache Kafka
| Affected software | Apache Kafka |
|---|---|
| Severity | 7.5 High CVSS 3.1 |
| Fixed in | 3.9.1 |
| Weakness | Server-side request forgery (CWE-918) |
| Published | 10 Jun 2025 |
| Updated | 17 Jun 2026 |
Description
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 1 citation · 2 exploits · earliest 2026-04-08.
- CISA Vulnrichment exploitation: none
- Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2025-07-04.
- EPSS 70% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2025-27817 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | tracker.crowdsec.net | /cves/CVE-2025-27817 | 2026-04-08 |
| Exploit reference | VulnCheck XDB de794ec39752 | Exploit type: infoleak | 2025-06-12 |
| Exploit reference | VulnCheck XDB 0df121059699 | Exploit type: infoleak | 2025-07-04 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache Kafka 4.1.0 (KRaft) with Keycloak OAuth2 authentication using Strimzi - bypasses CVE-2025-27817 URL allowlist restriction | 5 | 2025-10-13 |
| GitHub PoC | Apache Kafka客户端未对用户输入进行严格验证和限制，未经身份验证的攻击者可通过构造恶意配置读取环境变量或磁盘任意内容，或向非预期位置发送请求，提升REST API的文件系统/环境/URL访问权限。 | 5 | 2025-07-04 |
| Nuclei | Apache Kafka Client - Arbitrary File Read |
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection none
- Action unverified
- Review automated Inferred
- Record active
| Decided by | The affected package being open source on Maven, so the fix can be read |
|---|---|
| Finding | This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.kafka:kafka-clients), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on. |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2026 ↗ | CPU | 2026-Q3 | Oracle SQL Developer / Installation (Apache Kafka) (19.3-24.3) |
| Oracle Critical Patch Update April 2026 ↗ | CPU | 2026-Q2 | Oracle Financial Services Applications / Base (Apache Kafka) (14.5.0.0.0-14.8.0.0.0) Oracle Financial Services Applications / Common (Apache Kafka) (14.5.0.0.0-14.8.0.0.0) Oracle Financial Services Applications / Configuration (Apache Kafka) (14.6.0.0.0-14.8.0.0.0) Oracle Financial Services Applications / Core (Apache Kafka) (14.5.0.0.0-14.8.0.0.0) Oracle Financial Services Applications / Dashboard (Apache Kafka) (14.5.0.0.0-14.8.0.0.0) Oracle Financial Services Applications / Security (Apache Kafka) (14.5.0.0.0-14.8.0.0.0) Oracle Siebel CRM / Event Publish and Subscribe (Apache Kafka) (17.0-26.2) |
| Oracle Critical Patch Update January 2026 ↗ | CPU | 2026-Q1 | Oracle Financial Services Applications / Accessibility (Apache Kafka) (14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0) Oracle Financial Services Applications / Common Core (Apache Kafka) (14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0) Oracle Siebel CRM / Application Interface (Apache Kafka) (17.0-25.10) |
| Oracle Critical Patch Update October 2025 ↗ | CPU | 2025-Q4 | Oracle Communications Applications / Core (Apache Kafka) (6.1.0-6.1.1) Oracle Communications Applications / Notification Gateway (Apache Kafka) (12.0.3.0.0-12.0.6.0.0, 15.0.0.0.0-15.0.1.0.0, 15.1.0.0.0) Oracle Communications Applications / Notification Gateway (Apache Kafka) (12.0.3.0.0-12.0.6.0.0, 15.0.0.0.0-15.0.1.0.0, 15.1.0.0.0) Oracle Communications Applications / Platform (Apache Kafka) (12.0.0.4.0-15.0.1.0.0) Oracle Communications Applications / Solution Designer (Apache Kafka) (8.0.0.5.0, 8.1.0.4.0, 8.2.0.1.0) Oracle Financial Services Applications / Reports (Apache Kafka) (14.5.0.0.0-14.8.0.0.0) Oracle Fusion Middleware / Adapters (Apache Kafka) (14.1.2.0.0) |
| Oracle Critical Patch Update July 2025 ↗ | CPU | 2025-Q3 | Oracle Financial Services Applications / Platform (Apache Kafka) (8.0.7.8, 8.0.8.6, 8.1.1.4, 8.1.2.5) Oracle Financial Services Applications / Platform (Apache Kafka) (8.0.8) Oracle Financial Services Applications / Platform (Apache Kafka) (8.0.8.1, 8.1.2.8, 8.1.2.9) Oracle Fusion Middleware / Third Party (Apache Kafka) (12.2.1.4.0, 14.1.2.0.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Core (Apache Kafka) | 6.1.0-6.1.1 | |
| Oracle Communications Applications | Notification Gateway (Apache Kafka) | 12.0.3.0.0-12.0.6.0.0, 15.0.0.0.0-15.0.1.0.0, 15.1.0.0.0 | 15.1.0.0.0 |
| Oracle Communications Applications | Platform (Apache Kafka) | 12.0.0.4.0-15.0.1.0.0 | |
| Oracle Communications Applications | Solution Designer (Apache Kafka) | 8.0.0.5.0, 8.1.0.4.0, 8.2.0.1.0 | 8.0.0.5.0 · 8.1.0.4.0 · 8.2.0.1.0 |
| Oracle Financial Services Applications | Accessibility (Apache Kafka) | 14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0 | 14.5.0.15.0 · 14.6.0.11.0 · 14.7.0.9.0 · 14.8.0.1.0 · 14.8.1.0.0 |
| Oracle Financial Services Applications | Base (Apache Kafka) | 14.5.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Common (Apache Kafka) | 14.5.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Common Core (Apache Kafka) | 14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0 | 14.5.0.15.0 · 14.6.0.11.0 · 14.7.0.9.0 · 14.8.0.1.0 · 14.8.1.0.0 |
| Oracle Financial Services Applications | Configuration (Apache Kafka) | 14.6.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Core (Apache Kafka) | 14.5.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Dashboard (Apache Kafka) | 14.5.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Platform (Apache Kafka) | 8.0.7.8, 8.0.8.6, 8.1.1.4, 8.1.2.5 | 8.0.7.8 · 8.0.8 · 8.0.8.1 · 8.0.8.6 · 8.1.1.4 · 8.1.2.5 · 8.1.2.8 · 8.1.2.9 |
| Oracle Financial Services Applications | Reports (Apache Kafka) | 14.5.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Security (Apache Kafka) | 14.5.0.0.0-14.8.0.0.0 | |
| Oracle Fusion Middleware | Adapters (Apache Kafka) | 14.1.2.0.0 | 14.1.2.0.0 |
| Oracle Fusion Middleware | Third Party (Apache Kafka) | 12.2.1.4.0, 14.1.2.0.0 | 12.2.1.4.0 · 14.1.2.0.0 |
| Oracle SQL Developer | Installation (Apache Kafka) | 19.3-24.3 | |
| Oracle Siebel CRM | Application Interface (Apache Kafka) | 17.0-25.10 | |
| Oracle Siebel CRM | Event Publish and Subscribe (Apache Kafka) | 17.0-26.2 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.kafka:kafka-clients |
3.1.0 | 3.9.1 |
unbounded |
Products and versions
2 products, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | kafka | generic | ≥ 3.1.0 and ＜ 3.9.1 |
| osv | org.apache.kafka | kafka-clients | generic | ≥ 3.1.0 and ＜ 3.9.1 |
References
| URL | Tags |
|---|---|
| https://github.com/apache/kafka | PACKAGE |
| https://kafka.apache.org/cve-list | WEB |
| http://www.openwall.com/lists/oss-security/2025/06/09/1 | WEB |
Timeline
Timeline
| Published | 2025-06-10 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2026-04-08 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |