Apache Kafka vulnerabilities and CVEs

Known vulnerabilities affecting Apache Kafka, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

12 vulnerabilities tracked.

9.1 Kafka Streams derives its stream-time clock from record timestamps. CVE-2026-111496 28 Oct 2026
9.1 Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a… CVE-2026-111115 28 Oct 2026
9.1 Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. CVE-2026-111108 28 Oct 2026
9.1 A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its… CVE-2026-110985 28 Oct 2026
8.8 Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a… CVE-2026-115644 28 Oct 2026
8.1 Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector… CVE-2026-116593 28 Oct 2026
7.5 Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or… CVE-2026-111551 28 Oct 2026
6.5 When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and… CVE-2026-114349 28 Oct 2026
6.5 An authenticated Kafka principal with no authorization grants (not even ALTERCONFIGS) can make a broker read a file or an environment… CVE-2026-112375 28 Oct 2026
6.5 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes… CVE-2026-111073 28 Oct 2026
6.5 Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all… CVE-2026-83525 28 Oct 2026
5.9 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature,… CVE-2026-110952 28 Oct 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Apache Kafka is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here