Vulnerability Directory | CVE-2025-27817 | Spring

Overview

Apache Kafka is a distributed streaming platform designed for building real-time data pipelines and event-driven applications at enterprise scale. It offers a high-throughput, fault-tolerant messaging system that enables applications to publish, store, and process continuous streams of records with low latency.

A security vulnerability (CVE-2025-27817) has been identified in Apache Kafka, affecting kafka-clients and posing heightened risk in Kafka Connect deployments where configuration values may originate from untrusted sources. Because Kafka Clients allow OAuth-based SASL settings such as sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url to be supplied through client or connector configuration, an attacker with that ability can exploit these fields to trigger arbitrary file reads or SSRF, potentially escalating limited REST API access into unintended filesystem, environment-variable, or outbound network access.

Per OWASP: Server-Side Request Forgery (SSRF) occurs when an application lets user-controlled input influence outbound network requests, allowing attackers to make the server contact unintended internal or external resources. By manipulating URLs or request parameters, an attacker can access sensitive internal services, retrieve protected data, or pivot deeper into the environment. Without strict validation or allow-listing, SSRF can bypass network controls and lead to significant compromise.

This issue affects multiple versions of Apache Kafka kafka-clients.

‍

Details

Module Info

Product: Apache Kafka
Affected packages: kafka-clients
Affected versions: >=3.1.0 <3.9.1
GitHub repository: https://github.com/apache/kafka/
Published packages: https://central.sonatype.com/artifact/org.apache.kafka/kafka-clients
Package manager: Maven
Fixed In: NES for Spring Boot 2.7

‍

Vulnerability Info

This high-severity vulnerability is found in the kafka-client package in all published versions of Apache Kafka.

‍

Apache Kafka Clients accept configuration data for establishing SASL/OAUTHBEARER connections, including fields such as sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, which can influence how the client retrieves tokens or key material. Because these settings may reference local files or remote URLs, Kafka Clients can end up reading file contents into error logs or issuing outbound requests on behalf of the application. In deployments where untrusted parties can supply Kafka Client or connector configuration, attackers may exploit these fields to trigger arbitrary file reads, leak environment information, or perform SSRF to unintended destinations. In particular, this flaw can be used in Kafka Connect to escalate limited REST API access into filesystem, environment, or network access.

‍

Steps To Reproduce

Configure a Kafka Client sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url with a rogue URL.

‍

Proof Of Concept

When Kafka attempts to obtain a token or JWKS from a rogue location, it will:

Read from the file system (if given a file://-style reference), and in error conditions may emit file contents into error logs.
Make outbound HTTP requests (SSRF), even to internal or restricted services.

‍

Mitigation

Only recent versions of Apache Kafka are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations: