This vulnerability in STRIMZI Project's Kafka Connect REST API (versions up to 0.41.0) arises from improper access control. An attacker without privileges can exploit the MirrorMaker Kafka REST API to disrupt Kafka Mirroring service (denial of service), bypass Kafka ACLs to mirror topic content to an attacker-controlled Kafka cluster, and potentially steal SASL credentials used for Kafka authentication. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to complete denial of Kafka Mirroring service, unauthorized data exfiltration of Kafka topics to an attacker’s Kafka cluster bypassing existing ACLs, and theft of sensitive Kafka SASL credentials. This compromises confidentiality, integrity, and availability of Kafka data streams managed by STRIMZI Kafka Connect.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Kafka Connect REST API and MirrorMaker endpoints to trusted users and networks only. Monitor for unusual connector creation or mirroring activity. Avoid exposing the REST API to untrusted networks.