What is the CVSS score of CVE-2025-27817?

CVE-2025-27817 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 17.5%.

Which versions of Kafka are affected by CVE-2025-27817?

Apache Kafka Client configurations can be exploited to read arbitrary files, access environment variables, or make unauthorized network requests, potentially exposing sensitive data and credentials.. A patch is available.

Is there a public PoC exploit available for CVE-2025-27817?

Yes, a public proof-of-concept exploit is available for CVE-2025-27817. Prioritise patching immediately. EPSS: 17.5%.

How to fix or mitigate CVE-2025-27817?

Within 24 hours: Inventory all systems running Apache Kafka Clients and identify which versions are deployed; assess whether untrusted parties can influence SASL/OAUTHBEARER configuration parameters. Within 7 days: Implement network segmentation to restrict Kafka Client outbound connections to known, authorized endpoints; disable SASL/OAUTHBEARER authentication if not actively used. Within 30 days: Upgrade to Apache Kafka 3.9.1, 4.0.0, or later once patches are fully released and tested; conduct configuration audit to ensure only trusted sources can specify authentication endpoints.

Kafka CVE-2025-27817

EUVD-2025-17640 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2025-06-10 security@apache.org

GHSA-vgq5-3255-v292

Apache SSRF Kafka Red Hat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17640

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 08:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

521 maven packages depend on org.apache.kafka:kafka-clients (163 direct, 358 indirect)

Ecosystem-wide dependent count for version 3.1.0.

DescriptionCVE.org

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products.

Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.

AnalysisAI

A SSRF vulnerability in A possible arbitrary file read and SSRF vulnerability (CVSS 7.5) that allows clients. Risk factors: EPSS 17% exploitation probability.