CVE-2026-41115
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An improper authorization vulnerability has been identified in Apache Kafka. The CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation as documented. This can result in misconfigured ACLs and unintended security postures.
Risk Assessment
Incorrect permissions may allow users with DESCRIBE permission to access sensitive group metadata, while users with READ may unnecessarily join groups, violating the principle of least privilege.
Recommendation
Review existing group ACLs in Kafka and adjust them to follow the principle of least privilege. Documentation and KIP-848 will be updated.
Other vulnerabilities in Apache Kafka
See all- CVE-2026-33557Critical
In Apache Kafka, the default JWT validator class (`DefaultJwtValidator`) accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a token from any issuer with any username, and the broker will accept it.
- CVE-2026-35554High
A race condition in the Apache Kafka Java producer client's buffer pool management can cause messages to be silently delivered to incorrect topics. The issue is fixed in newer versions.
Original NVD description (English source)
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.