CVE-2025-27819— Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration
Quick assessment
Affected
Apache Software Foundation Apache Kafka
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Kafka是美国阿帕奇（Apache）基金会的一套开源的分布式流媒体平台。该平台能够获取实时数据，用于构建对数据流的变化进行实时反应的应用程序。 Apache Kafka存在安全漏洞，该漏洞源于SASL JAAS JndiLoginModule配置不当，可能导致远程代码执行和拒绝服务攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-27819
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration
Source: CVE Program / CVE List V5
Vulnerability Description
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Kafka 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Kafka是美国阿帕奇（Apache）基金会的一套开源的分布式流媒体平台。该平台能够获取实时数据，用于构建对数据流的变化进行实时反应的应用程序。 Apache Kafka存在安全漏洞，该漏洞源于SASL JAAS JndiLoginModule配置不当，可能导致远程代码执行和拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Kafka | 2.0.0 ~ 3.3.2 | - |
|
II. Public POCs for CVE-2025-27819
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-27819
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2025-06-10 · 8 CVEs total
| CVE-2025-30675 | 4.7 MEDIUM | Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins |
| CVE-2025-27818 | Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration | |
| CVE-2025-27817 | Apache Kafka Client: Arbitrary file read and SSRF vulnerability | |
| CVE-2025-47713 | Apache CloudStack: Domain Admin can reset Admin password in Root Domain | |
| CVE-2025-47849 | Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain | |
| CVE-2025-26521 | Apache CloudStack: CKS cluster in project exposes user API keys | |
| CVE-2025-22829 | Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin |
IV. Related Vulnerabilities
Same product: Apache Kafka
-
CVE-2026-41115
Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCR -
CVE-2026-33557
Apache Kafka: Missing JWT token validation in OAUTHBEARER au -
CVE-2026-33558
Apache Kafka, Apache Kafka Clients: Information Exposure Thr -
CVE-2025-27818
Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginMod -
CVE-2024-56128
Apache Kafka: SCRAM authentication vulnerable to replay atta
Same vendor: Apache Software Foundation
-
CVE-2026-103636
Apache DataSketches: datasketches-cpp: Out-of-bounds read in -
CVE-2026-103635
Apache DataSketches: datasketches-cpp: Out-of-bounds read in -
CVE-2026-103513
Apache DataSketches: datasketches-cpp: Out-of-bounds read an -
CVE-2026-103501
Apache DataSketches: datasketches-cpp: HLL CouponList Deseri -
CVE-2026-103413
Apache Camel Karavan: unvalidated Kubernetes resources appli
Same weakness: CWE-502
-
CVE-2026-81797
WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme -
CVE-2026-78535
WordPress Photolia theme <= 1.0.3 - PHP Object Injection vul -
CVE-2026-78533
WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulner -
CVE-2026-78531
WordPress Jacqueline theme <= 2.22 - PHP Object Injection vu -
CVE-2026-78529
WordPress Alliance theme <= 3.11 - PHP Object Injection vuln
V. Comments for CVE-2025-27819
No comments yet