Поиск уязвимостей
Количество 7
Количество 7
CVE-2025-27817
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0....
CVE-2025-27817
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.0,
GHSA-vgq5-3255-v292
Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability
BDU:2025-06880
Уязвимость конфигурации sasl.oauthbearer.token.endpoint.url и sasl.oauthbearer.jwks.endpoint.url клиента диспетчера сообщений Apache Kafka, позволяющая нарушителю осуществить SSRF-атаку
ROS-20250804-02
Множественные уязвимости apache-kafka
ALT-PU-2025-14435
ALT-PU-2025-14435: package `kafka` update to version 3.9.1-alt1
ALT-PU-2025-14361
ALT-PU-2025-14361: package `kafka` update to version 3.9.1-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-27817 A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.... | CVSS3: 8.1 | 70% Средний | больше 1 года назад |
 | CVE-2025-27817 A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.0, | CVSS3: 7.5 | 70% Средний | больше 1 года назад |
| GHSA-vgq5-3255-v292 Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability | CVSS3: 7.5 | 70% Средний | больше 1 года назад |
 | BDU:2025-06880 Уязвимость конфигурации sasl.oauthbearer.token.endpoint.url и sasl.oauthbearer.jwks.endpoint.url клиента диспетчера сообщений Apache Kafka, позволяющая нарушителю осуществить SSRF-атаку | CVSS3: 7.5 | 70% Средний | больше 1 года назад |
 | ROS-20250804-02 Множественные уязвимости apache-kafka | CVSS3: 9.9 | больше 1 года назад | |
| ALT-PU-2025-14435 ALT-PU-2025-14435: package `kafka` update to version 3.9.1-alt1 | CVSS3: 9.9 | 12 месяцев назад | |
| ALT-PU-2025-14361 ALT-PU-2025-14361: package `kafka` update to version 3.9.1-alt1 | CVSS3: 9.9 | 12 месяцев назад |
Уязвимостей на страницу