CVE-2026-41115 identifies an improper authorization vulnerability in Apache Kafka 4.0.0 where the CONSUMER_GROUP_DESCRIBE API enforces DESCRIBE permissions on GROUP resources rather than READ permissions as stated in Kafka documentation and KIP-848. This mismatch can cause administrators to misconfigure ACLs, inadvertently granting users access to sensitive group metadata or allowing users without READ permission but with DESCRIBE permission to access group information. The actual implementation is correct, and the vendor plans to update documentation to reflect this. Users should audit existing group ACLs to maintain proper access control.

The impact is primarily administrative and configuration-based. Misalignment between implementation and documentation can lead to ACL misconfigurations, potentially allowing unauthorized users to access or synchronize consumer group metadata. There is no indication of a direct exploit or code-level bypass, but improper ACLs could expose sensitive group information.

No official patch or fix is currently indicated. The vendor confirms the implementation is correct and will update documentation and KIP-848 accordingly. Users should review and audit existing consumer group ACLs to ensure they follow the principle of least privilege and do not grant excessive permissions based on outdated documentation.