PT-2025-24620 · Apache+2 · Apache Kafka+2

Ra1Lgun · Published 2025-06-09 · Updated 2026-02-28 · CVE-2025-27818

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 2.0.0 through 3.9.0 Apache Kafka versions 3.0.0 through 3.9.0, where users are allowed to specify properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations Apache Kafka versions 3.9.1 and 4.0.0, where a system property ("-Dorg.apache.kafka.disallowed.login.modules") has been added to disable problematic login modules usage in SASL JAAS configuration

Description A possible security vulnerability has been identified in Apache Kafka, requiring access to alterConfig to the cluster resource or Kafka Connect worker, and the ability to create or modify connectors with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol. This vulnerability allows an attacker to execute Java deserialization gadget chains on the Kafka Connect server, potentially causing unrestricted deserialization of untrusted data or RCE vulnerability when there are gadgets in the classpath. The sasl.jaas.config property can be set to "com.sun.security.auth.module.LdapLoginModule" via the producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config properties, allowing the server to connect to the attacker's LDAP server and deserialize the LDAP response.

Recommendations For Apache Kafka versions 2.0.0 through 3.9.0, validate connector configurations and only allow trusted LDAP configurations. Examine connector dependencies for vulnerable versions and either upgrade the connectors, upgrade the specific dependency, or remove the connectors as options for remediation. For Apache Kafka versions 3.0.0 through 3.9.0, implement a connector client config override policy to control which Kafka client properties can be overridden directly in a connector config and which cannot. For Apache Kafka versions 3.9.1 and 4.0.0, leverage the "org.apache.kafka.disallowed.login.modules" system property to disable problematic login modules usage in SASL JAAS configuration. Additionally, implement a connector client config override policy to control which Kafka client properties can be overridden directly in a connector config and which cannot.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2025-14361

ALT-PU-2025-14435

BDU:2025-08198

BIT-KAFKA-2025-27818

CVE-2025-27818

GHSA-76QP-H5MR-FRR4

Affected Products

Alt Linux

Apache Kafka

Red Os

References · 15

• https://osv.dev/vulnerability/BIT-kafka-2025-27818 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08198 · Security Note
• https://kafka.apache.org/cve-list · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27818 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27818 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-76qp-h5mr-frr4 · Vendor Advisory
• https://github.com/apache/kafka · Note
• https://t.me/cvetracker/25876 · Telegram Post
• https://openwall.com/lists/oss-security/2025/06/09/2 · Note
• https://kafka.apache.org/cve-list.html · Note
• https://t.me/cvenotify/125216 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-apache-kafka-cve-2025-27817-cve-2025-27818-cve-2025-27819 · Note
• https://twitter.com/CVEnew/status/1932352501623525476 · Twitter Post
• http://openwall.com/lists/oss-security/2025/06/09/2 · Note