Improper Authorization in Apache Kafka Leading to Access Control Issues
CVE-2026-41115

4.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Kafka
Vendor
CVE Published:
2 June 2026

What is CVE-2026-41115?

An improper authorization vulnerability has been found within Apache Kafka related to the CONSUMER_GROUP_DESCRIBE API. This issue arises due to the validation of the DESCRIBE operation on the GROUP resource instead of the READ operation as stipulated in existing documentation and KIP-848. Such an error can lead to misconfigured Access Control Lists (ACLs), resulting in situations where users may gain READ permissions inadvertently or access sensitive metadata without the appropriate privileges. It’s important for users to review and rectify existing group ACL configurations to adhere to the principle of least privilege and mitigate potential risks associated with this vulnerability.

Affected Version(s)

Apache Kafka 4.0.0 <= 4.3.0

References

https://kafka.apache.org/cve-list
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Luke Chen <showuon@gmail.com>
.