en
Severity across 11 analyzed records
Verify to analyze this security profile
As of 09/18/2026, within CyStack's analyzed data, Apache Kafka has 0 security vulnerabilities published in the last 90 days. Of these, 0 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Kafka and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-41115Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API | Exploitation statusNot known exploited | FixYes | Published06/02/2026 | SeverityMedium |
CVE-2026-33557Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication | Exploitation statusNot known exploited | FixYes | Published04/20/2026 | SeverityCritical |
CVE-2026-33558Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output | Exploitation statusNot known exploited | FixYes | Published04/20/2026 | SeverityMedium |
CVE-2025-27819Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration | Exploitation statusNot known exploited | FixYes | Published06/10/2025 | SeverityHigh |
CVE-2025-27818Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration | Exploitation statusNot known exploited | FixYes | Published06/10/2025 | SeverityHigh |
CVE-2024-56128Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption | Exploitation statusNot known exploited | FixYes | Published12/18/2024 | SeverityMedium |
CVE-2024-27309Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode | Exploitation statusNot known exploited | FixYes | Published04/12/2024 | SeverityHigh |
CVE-2022-34917Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers | Exploitation statusNot known exploited | FixNot confirmed | Published09/20/2022 | SeverityHigh |
CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and Clients | Exploitation statusNot confirmed | FixNot confirmed | Published09/22/2021 | SeverityUnknown |
CVE-2018-1288 | Exploitation statusNot confirmed | FixNot confirmed | Published07/26/2018 | SeverityUnknown |
CVE-2017-12610 | Exploitation statusNot confirmed | FixNot confirmed | Published07/26/2018 | SeverityUnknown |
