Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration

Summary

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

Timeline

1. Jun 10, 2025, 7:54 AM UTCCVE published
2. Jun 10, 2025, 2:18 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jun 10, 2025, 3:15 PM UTCRecord last updated

Affected versions

• Apache Software Foundation Apache Kafka

  From 2.0.0 · through 3.3.2

• org.apache.kafka:kafka_2.10Maven

  All versions

• org.apache.kafka:kafka_2.11Maven

  All versions

• org.apache.kafka:kafka_2.12Maven

  fixed in 3.4.0

• org.apache.kafka:kafka_2.13Maven

  fixed in 3.4.0

• org.apache.kafka:kafka_2.8.0Maven

  All versions

• org.apache.kafka:kafka_2.8.2Maven

  All versions

• org.apache.kafka:kafka_2.9.1Maven

  All versions

• org.apache.kafka:kafka_2.9.2Maven

  All versions

References 1