Apache Kafka Client up to 3.9.0 server-side request forgery

Summaryinfo

A vulnerability classified as critical has been found in Apache Kafka Client up to 3.9.0. This affects an unknown part. Performing a manipulation results in server-side request forgery. This vulnerability is cataloged as CVE-2025-27817. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache Kafka Client up to 3.9.0. This affects some unknown processing. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.

The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-27817 since 03/07/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/07/2026).

The vulnerability scanner Nessus provides a plugin with the ID 276292 (TencentOS Server 4: kafka (TSSA-2025:0475)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.9.1 or 4.0.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (276292), EUVD (EUVD-2025-17640) and CERT Bund (WID-SEC-2025-1269). Further details are available at seclists.org. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• IBM Security Guardium
• IBM Maximo Asset Management
• Red Hat Enterprise Linux
• IBM Operational Decision Manager
• IBM Business Automation Workflow
• IBM InfoSphere Data Replication
• IBM InfoSphere Information Server
• Apache Kafka
• IBM QRadar SIEM
• IBM App Connect Enterprise
• IBM Integration Bus
• IBM Tivoli Network Manager

Productinfo

Vendor

• Apache

Name

• Kafka Client

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion