CVE-2026-83525 in Kafka
Summary
by MITRE • 10/28/2026
Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions.
Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as CVE-2025-XXXX involves a critical logic error within the FetchSnapshot RPC handler of Apache Kafka, specifically affecting versions from 2.8.0 up to but not including 4.2.2, and from 4.3.0 up to but not including 4.3.2 across all supported platforms. This flaw is categorized under CWE-480, which denotes the use of an incorrect operator in a conditional statement or logical expression. The core technical issue arises when the system processes a FetchSnapshotRequest that contains either an empty topics array or references a topic that has no partitions assigned to it. In these specific scenarios, the application fails to properly validate input parameters before proceeding with snapshot retrieval operations, leading to unexpected control flow and subsequent termination of the controller process. This represents a significant failure in defensive programming practices where edge cases involving null or empty collections are not adequately handled by robust error checking mechanisms.
From an operational perspective, this vulnerability allows for a severe denial of service condition against the Kafka cluster infrastructure. Because the attack vector targets the controller process, which is responsible for managing metadata and coordinating broker activities within the distributed system, its termination can lead to widespread instability or complete unavailability of the messaging platform. An authenticated attacker possessing CLUSTER_ACTION privileges can exploit this flaw by crafting a malicious FetchSnapshotRequest that triggers the faulty logic path. The resulting crash disrupts service continuity, potentially causing data ingestion delays, consumer lag accumulation, and loss of leadership for partition replicas until the controller is restarted or replaced within the cluster quorum. This impact underscores the critical importance of maintaining high availability in distributed messaging systems where even a single point of failure can cascade into broader operational disruptions.
The exploitation of this vulnerability aligns with ATT&CK techniques related to resource hijacking and service disruption, specifically targeting infrastructure components rather than individual endpoints or user accounts. The requirement for CLUSTER_ACTION privilege indicates that the attacker must already have elevated access within the Kafka security model, which may limit the scope of potential attackers but highlights the risk associated with over-privileged service accounts or compromised administrative credentials. Mitigation strategies primarily involve upgrading to patched versions such as 4.2.2, 4.3.2, or later releases like 4.4.0 where this logic error has been corrected. For organizations running unsupported branches such as 4.1.x and earlier, immediate migration to version 4.2.2 or newer is strongly advised to ensure access to current security patches and stability improvements. Additionally, implementing strict input validation at the application layer and adhering to least privilege principles can help reduce the attack surface while waiting for infrastructure updates.