CVE-2025-27818: Apache Kafka Deserialization of Untrusted Data Vulnerability
Summary
CVE-2025-27818: Apache Kafka Deserialization of Untrusted Data vulnerability. Affects org.apache.kafka:kafka versions >= 2.3.0, < 3.9.1. Fixed in 3.9.1. How to fix ↓
Also tracked for
- kafka · Bitnami
The same CVE-2025-27818 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is a distributed event streaming platform capable of handling trillions of events a day. It is designed for high-throughput, fault-tolerant, and scalable data processing. Kafka Connect is a tool for scalable and reliable streaming of data between Apache Kafka and other systems. This vulnerability affects Kafka Connect configurations, allowing potential exploitation through misconfigured SASL JAAS settings.
Vulnerability Detail
A security vulnerability exists in Apache Kafka that allows an authenticated operator to set the 'sasl.jaas.config' property for any connector's Kafka clients to 'com.sun.security.auth.module.LdapLoginModule'. This misconfiguration enables the server to connect to an attacker's LDAP server and deserialize the LDAP response, leading to unrestricted deserialization of untrusted data. This could result in remote code execution (RCE) if there are exploitable gadgets in the classpath. The vulnerability has been present since Apache Kafka version 2.0.0 and can be exploited by users with alterConfig access to the cluster resource or Kafka Connect worker.
How To Fix
Minimum fixed version
3.9.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the problematic login modules in SASL JAAS configuration by adding the following system property when starting your Kafka Connect server:
-Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule
This will prevent the use of these modules until you can upgrade to a patched version.
Conclusion
The Apache Kafka vulnerability CVE-2025-27818 poses a significant risk due to its potential for remote code execution through misconfigured SASL JAAS settings. Users are strongly advised to upgrade to version 3.9.1 or later to mitigate this risk. Additionally, implementing the provided workaround can help secure systems until an upgrade is feasible.
See every vulnerability recorded for org.apache.kafka:kafka →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
The vulnerability affects Apache Kafka versions from 2.3.0 up to 3.9.0.
Exploitation of this vulnerability can lead to remote code execution (RCE) on the Kafka Connect server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
If immediate upgrading is not possible, implement the workaround by disabling the problematic login modules in your Kafka Connect configuration.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka.
