CVE-2025-27817: Apache Kafka Client Arbitrary File Read and SSRF Vulnerability
Summary
CVE-2025-27817: Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability. Affects org.apache.kafka:kafka-clients versions >= 3.1.0, < 3.9.1. Fixed in 3.9.1. How to fix ↓
Also tracked for
- kafka · Bitnami
The same CVE-2025-27817 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is a distributed streaming platform that is used for building real-time data pipelines and streaming applications. It is designed to handle high throughput and fault tolerance, making it a popular choice for enterprises. The Kafka Client is responsible for connecting to Kafka brokers, and it accepts various configuration parameters, including those for SASL/OAUTHBEARER authentication. This vulnerability allows for potential security risks when configurations are set by untrusted parties.
Vulnerability Detail
A vulnerability has been identified in the Apache Kafka Client that allows for arbitrary file reading and server-side request forgery (SSRF). This issue arises from the acceptance of configuration data for SASL/OAUTHBEARER connections, specifically the 'sasl.oauthbearer.token.endpoint.url' and 'sasl.oauthbearer.jwks.endpoint.url'. Attackers can exploit this flaw to read arbitrary files from the disk or environment variables, or to send requests to unintended locations. This is particularly concerning in environments where Kafka Clients are configured by untrusted sources, as it can lead to unauthorized access to sensitive data and escalation of privileges, especially in SaaS applications.
How To Fix
Minimum fixed version
3.9.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, you can mitigate the risk by ensuring that the configuration parameters 'sasl.oauthbearer.token.endpoint.url' and 'sasl.oauthbearer.jwks.endpoint.url' are not set to untrusted sources. This can help prevent unauthorized file access and SSRF attacks.
Conclusion
The Apache Kafka Client vulnerability CVE-2025-27817 poses significant risks if not addressed. By updating to the latest version and configuring allowed URLs, you can mitigate these risks effectively. Utilizing tools like Vulert can help monitor your applications for such vulnerabilities in real-time.
See every vulnerability recorded for org.apache.kafka:kafka-clients →
FAQ
CVE-2025-27817 is a vulnerability in the Apache Kafka Client that allows for arbitrary file reading and server-side request forgery (SSRF).
If your application uses Apache Kafka Clients with configurations set by untrusted parties, it may be susceptible to unauthorized file access and SSRF attacks.
Versions of Apache Kafka Client from 3.1.0 to 3.9.0 are affected. It is recommended to upgrade to version 3.9.1 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a moderate to high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka-clients.
