Kafka
Monthly
A single crafted Kafka record can permanently crash-loop a Motor.NET service running any version before 0.19.0 that consumes a topic with CloudEvents message handling. The record declares content-type application/cloudevents+json but omits the mandatory CloudEvent attributes id, source and type, causing an ArgumentException inside KafkaMessageConsumer.SingleMessageHandlingAsync that the framework treats as fatal; the host stops, and because the same poison record is re-consumed on every restart, the service never recovers until the message is removed or the software is upgraded. The authoritative CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) rates this as a high-availability-impact, unauthenticated denial of service with no confidentiality or integrity exposure; the key environmental precondition is that the attacker can produce records to the consumed topic (Kafka-level produce authorization). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.19.0 as the complete fix.
Arbitrary code execution in the control plane of Apache Airflow deployments using the Apache Kafka provider 1.15.0 up to but not including 2.0.0: an authenticated user who can edit Airflow connections (PR:L) can plant a dotted-path string in a Kafka connection's extra field that the provider resolves into a Python callable via import_string without any allowlist, and confluent-kafka then invokes it inside the scheduler process. Exploitation is conditional and the limiting factors are substantial: the Kafka event producer must be explicitly enabled through dag_run_events_enabled or task_instance_events_enabled (both disabled by default), and the broker must be a plain Kafka cluster or Amazon MSK, since Google Managed Kafka overwrites the user-supplied oauth_cb and is unaffected. This breaks the Airflow security model because connection-configuration users are only supposed to reach code execution on workers, not the scheduler, and EPSS is low at 0.45% (38th percentile) with no public exploit identified at time of analysis; the assessed vector uses AC:H to reflect the required preconditions.
A remote code execution vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A remote code execution vulnerability in A possible security vulnerability (CVSS 8.8). High severity vulnerability requiring prompt remediation.
A SSRF vulnerability in A possible arbitrary file read and SSRF vulnerability (CVSS 7.5) that allows clients. Risk factors: EPSS 17% exploitation probability.
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A security vulnerability has been identified in Apache Kafka. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required.
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
A single crafted Kafka record can permanently crash-loop a Motor.NET service running any version before 0.19.0 that consumes a topic with CloudEvents message handling. The record declares content-type application/cloudevents+json but omits the mandatory CloudEvent attributes id, source and type, causing an ArgumentException inside KafkaMessageConsumer.SingleMessageHandlingAsync that the framework treats as fatal; the host stops, and because the same poison record is re-consumed on every restart, the service never recovers until the message is removed or the software is upgraded. The authoritative CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) rates this as a high-availability-impact, unauthenticated denial of service with no confidentiality or integrity exposure; the key environmental precondition is that the attacker can produce records to the consumed topic (Kafka-level produce authorization). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.19.0 as the complete fix.
Arbitrary code execution in the control plane of Apache Airflow deployments using the Apache Kafka provider 1.15.0 up to but not including 2.0.0: an authenticated user who can edit Airflow connections (PR:L) can plant a dotted-path string in a Kafka connection's extra field that the provider resolves into a Python callable via import_string without any allowlist, and confluent-kafka then invokes it inside the scheduler process. Exploitation is conditional and the limiting factors are substantial: the Kafka event producer must be explicitly enabled through dag_run_events_enabled or task_instance_events_enabled (both disabled by default), and the broker must be a plain Kafka cluster or Amazon MSK, since Google Managed Kafka overwrites the user-supplied oauth_cb and is unaffected. This breaks the Airflow security model because connection-configuration users are only supposed to reach code execution on workers, not the scheduler, and EPSS is low at 0.45% (38th percentile) with no public exploit identified at time of analysis; the assessed vector uses AC:H to reflect the required preconditions.
A remote code execution vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A remote code execution vulnerability in A possible security vulnerability (CVSS 8.8). High severity vulnerability requiring prompt remediation.
A SSRF vulnerability in A possible arbitrary file read and SSRF vulnerability (CVSS 7.5) that allows clients. Risk factors: EPSS 17% exploitation probability.
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A security vulnerability has been identified in Apache Kafka. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required.
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.