[<prev] [next>] [day] [month] [year] [list]
Message-ID: <97818c08-4edd-2460-cd62-71f66bc77f5d@apache.org>
Date: Tue, 02 Jun 2026 08:02:02 +0000
From: Luke Chen <showuon@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-41115: Apache Kafka: Improper Authorization in
CONSUMER_GROUP_DESCRIBE API
Severity: moderate
Affected versions:
- Apache Kafka 4.0.0 through 4.3.0
Description:
An improper authorization vulnerability has been identified in Apache Kafka.
The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
Credit:
Luke Chen <showuon@...il.com> (finder)
References:
https://kafka.apache.org/cve-list
https://kafka.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-41115
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
