CVE-2025-27817: Apache Kafka Client · Arbitrary file read and SSRF vulnerability
Affects Apache Kafka ClientSource CVE Database V5
Not known to be exploited · public detection template (Nuclei) · 68% EPSS · CVSS 7.5 High.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 68.7% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Jun 2025
Detectable: evidence found.
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.apache.kafka/kafka-clientspkg:maven/org.apache.kafka/kafka-clientsOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
European organizations should take the following specific actions to mitigate this vulnerability: 1) Upgrade Apache Kafka Clients to version 4.0.0 or later, where the default configuration for allowed OAuth bearer URLs is an empty list, enforcing explicit URL whitelisting. 2) If upgrading is not immediately feasible, configure the system property "-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls" to explicitly whitelist only trusted and necessary URLs, thereby preventing arbitrary URL usage. 3) Audit all Kafka Client configurations, especially those exposed to untrusted sources such as REST APIs or multi-tenant SaaS environments, to ensure that OAuth bearer token endpoint URLs cannot be manipulated by attackers. 4) Implement strict access controls and authentication on Kafka Connect REST APIs to limit configuration changes to authorized personnel only. 5) Monitor Kafka client logs and network traffic for unusual requests or error messages that might indicate exploitation attempts. 6) Conduct penetration testing and code reviews focusing on SASL/OAUTHBEARER configurations to identify and remediate potential injection points. 7) Employ network segmentation and firewall rules to restrict outbound requests from Kafka clients to only trusted endpoints, limiting SSRF impact. 8) Maintain an incident response plan that includes this vulnerability to rapidly detect and respond to exploitation attempts.
Description
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.