CVE-2026-41115

An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://kafka.apache.org/cve-list	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/02/5	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-02 10:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-41115

Mitre link : CVE-2026-41115

CVE.ORG link : CVE-2026-41115

JSON object : View

Products Affected

apache

kafka

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-41115", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41115", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T16:49:44.110629Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "versions": [{"status": "affected", "version": "4.0.0", "versionType": "semver", "lessThanOrEqual": "4.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-02T10:16:25.107", "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/02/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability has been identified in Apache Kafka.\n\nThe implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.\n\nThe correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de autorizaci\u00f3n impropia en Apache Kafka.\n\nLa implementaci\u00f3n de la API CONSUMER_GROUP_DESCRIBE (69) valida la operaci\u00f3n DESCRIBE en el recurso GROUP en lugar de la operaci\u00f3n READ documentada en la documentaci\u00f3n oficial de Kafka y el KIP-848. Esta discrepancia puede resultar en Listas de Control de Acceso (ACLs) mal configuradas y posturas de seguridad no intencionadas, como otorgar permiso READ a usuarios que no deber\u00edan poder unirse/sincronizar grupos, o permitir a usuarios sin permiso READ (pero con permiso DESCRIBE) acceder a metadatos de grupo sensibles.\n\nEl permiso correcto para la API CONSUMER_GROUP_DESCRIBE es DESCRIBE GROUP, por lo que la implementaci\u00f3n actual es correcta. Sin embargo, la documentaci\u00f3n de Kafka, as\u00ed como el KIP-848, se actualizar\u00e1n para reflejar el permiso correcto. Aconsejamos a los usuarios de Kafka revisar las ACLs de grupo existentes para asegurar el principio de m\u00ednimo privilegio."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61D7227C-2896-457A-AE72-7D2957DACF19", "versionEndIncluding": "4.3.0", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}