CVE-2025-27818

published 2025-06-10

CVE-2025-27818: A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker…

Priority P2 59 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A possible security vulnerability has been identified in Apache Kafka.
This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0).
When configuring the broker via config file or AlterConfig command, or connector via the Kafka Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`
property for any of the connector's Kafka clients to "com.sun.security.auth.module.LdapLoginModule", which can be done via the
`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.
This will allow the server to connect to the attacker's LDAP server
and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.
Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box
configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector
client override policy that permits them.

Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage
in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" are disabled in Apache Kafka Connect 3.9.1/4.0.0.

We advise the Kafka users to validate connector configurations and only allow trusted LDAP configurations. Also examine connector dependencies for
vulnerab

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	kafka	>= 2.3.0 < 3.9.1	3.9.1
apache_software_foundation	apache_kafka	2.3.0 – 3.9.0	—

Detection & IOCs extracted from sources · hover to see the quote

other com.sun.security.auth.module.LdapLoginModule↗

other com.sun.security.auth.module.JndiLoginModule↗

command -Dorg.apache.kafka.disallowed.login.modules↗

• → Monitor Kafka Connect REST API calls that set `sasl.jaas.config`, `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` to values referencing LdapLoginModule or JndiLoginModule. ↗
• → Detect outbound LDAP connections originating from Kafka Connect worker processes, which may indicate exploitation — the server is connecting to an attacker-controlled LDAP server to trigger Java deserialization. ↗
• → Alert on AlterConfig commands targeting the cluster resource that include SASL JAAS configuration properties referencing LdapLoginModule or JndiLoginModule. ↗
• → Inspect connector configurations for the string `com.sun.security.auth.module.LdapLoginModule` or `com.sun.security.auth.module.JndiLoginModule` in any SASL JAAS config property as a sign of malicious configuration injection. ↗

• · Vulnerability is exploitable out-of-the-box only since Apache Kafka 3.0.0 / Kafka Connect 3.0.0; earlier versions require the cluster to have been explicitly reconfigured with a permissive connector client override policy. ↗
• · Exploitation requires the attacker to already hold `alterConfig` privileges on the cluster resource or Kafka Connect worker, limiting the attack surface to authenticated, privileged operators. ↗
• · RCE impact depends on the presence of Java deserialization gadget chains in the Kafka Connect server's classpath; environments without vulnerable gadgets may only be exposed to SSRF/data exfiltration via the rogue LDAP connection. ↗
• · The fix in Kafka 3.9.1/4.0.0 blocks LdapLoginModule and JndiLoginModule by default; older patched versions require explicit use of the `-Dorg.apache.kafka.disallowed.login.modules` JVM system property to achieve the same protection. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vendor_redhat 8.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502