PT-2025-24621 · Apache+2 · Apache Kafka+2
Jian Zhou
+2
·
Published
2025-06-09
·
Updated
2025-11-26
·
CVE-2025-27819
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Kafka versions prior to 3.4.0
Apache Kafka versions 3.4.0 through 3.9.0
Description
The issue concerns a Remote Code Execution (RCE) and Denial of Service attack via the SASL JAAS JndiLoginModule configuration in the Kafka Connect API and Apache Kafka brokers. To exploit this, an attacker needs to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
Recommendations
For Apache Kafka versions prior to 3.4.0, consider adding the system property "-Dorg.apache.kafka.disallowed.login.modules" to disable the problematic login modules usage in SASL JAAS configuration.
For Apache Kafka versions 3.4.0 through 3.9.0, ensure that "com.sun.security.auth.module.JndiLoginModule" is disabled, as it is by default in Apache Kafka 3.4.0.
For Apache Kafka versions 3.9.1 and 4.0.0, ensure that "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled, as it is by default.
Fix
DoS
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Kafka
Red Os