Kafka Migration Bug Affects ACL Enforcement

CVE-2024-27309

Summary

During the migration of an Apache Kafka cluster from ZooKeeper mode to KRaft mode, a vulnerability arises where Access Control Lists (ACLs) may not be enforced correctly. This issue occurs under specific conditions: when an administrator removes an ACL while the resource linked to that ACL retains two or more other existing ACLs. In such cases, Kafka may mistakenly interpret the resource as having only one ACL, which can lead to unintended access behavior. The problem resolves by either eliminating all brokers running in ZooKeeper mode or by assigning a new ACL to the compromised resource. Importantly, once the migration is finalized, the metadata remains intact, preventing data loss. However, the severity of impact depends on the nature of the configured ACLs; if only allow ACLs are present, there may be limited availability concerns, while deny ACLs could lead to more serious confidentiality and integrity risks during the transition.

References