Apache Kafka EUVD-2026-112210

Requires an authenticated principal with CLUSTER_ACTION authorization, a privileged cluster-level permission normally granted only to broker/controller identities - not to ordinary producers/consumers - so the practical attacker is a compromised or malicious broker or a holder of inter-broker credentials. The vulnerable code path is the KRaft FetchSnapshot RPC handler in KafkaRaftClient, meaning the target must be running a KRaft-based controller (ZooKeeper-mode deployments lack this Raft path, per the source-code evidence). The specific trigger is a FetchSnapshotRequest with an empty topics array or a topic carrying no partitions; the incorrect operator (CWE-480) causes the handler to index a non-existent element. Limiting factors: the CLUSTER_ACTION authorization requirement, the KRaft-mode prerequisite, and the availability-only (no data exposure) impact.

No official CVSS vector or EPSS score was supplied, and the vuln.today Decision label is 'monitor' - the lowest-urgency signal in this dataset. The flaw is confirmed by the Apache patch PR (#23185) and the Kafka CVE list, but there is no CISA KEV listing, no EPSS probability, and no exploit reference, so there is no indication of active or widespread exploitation. The impact is availability-only (controller process termination); there is no confidentiality or integrity consequence. Crucially, exploitation requires an authenticated principal holding CLUSTER_ACTION authorization, which is a privileged, cluster-level permission normally reserved for broker/controller identities rather than ordinary clients - this sharply limits the realistic attacker population to a compromised or malicious broker, or an actor who has already obtained inter-broker credentials. The code evidence places the bug in the KRaft raft module (KafkaRaftClient FetchSnapshot handler), so the exposure is specific to KRaft-mode deployments; this is inferred from the diff rather than stated in the description. Net: a genuine but lower-priority availability bug - the high privilege prerequisite and absence of exploitation signals outweigh the controller-crash impact, consistent with the 'monitor' decision label. Treat it as routine patching during maintenance rather than an emergency.

An actor who already holds CLUSTER_ACTION authorization (for example a compromised or rogue broker, or a stolen inter-broker credential) sends a crafted FetchSnapshotRequest whose topics array is empty or whose topic contains no partitions. The incorrect boolean operator in the handler's validation lets the request reach code that indexes the empty topic list, throwing an unhandled exception that terminates the KRaft controller process and causes a denial of service. No public exploit was identified at time of analysis; only the vendor patch and advisory are referenced.