Improper Authorization in Apache Kafka Leading to Access Control Issues

CVE-2026-41115

What is CVE-2026-41115?

An improper authorization vulnerability has been found within Apache Kafka related to the CONSUMER_GROUP_DESCRIBE API. This issue arises due to the validation of the DESCRIBE operation on the GROUP resource instead of the READ operation as stipulated in existing documentation and KIP-848. Such an error can lead to misconfigured Access Control Lists (ACLs), resulting in situations where users may gain READ permissions inadvertently or access sensitive metadata without the appropriate privileges. It’s important for users to review and rectify existing group ACL configurations to adhere to the principle of least privilege and mitigate potential risks associated with this vulnerability.

References