PT-2026-45725 · Apache · Apache Kafka
Published
2026-06-02
·
Updated
2026-06-02
·
CVE-2026-41115
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
An improper authorization vulnerability has been identified in Apache Kafka.
The implementation of the CONSUMER GROUP DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
The correct permission for CONSUMER GROUP DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Kafka