Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-02 | 2 | Disclosure1Patch1 |
| 2026-06-03 | 1 | Active Exploitation1 |
CVE-2026-41115: Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API https://www.openwall.com/lists/oss-security/2026/06/02/5 Severity: moderate
Post summary
A moderate‑severity CVE‑2026‑41115 for Apache Kafka, involving improper authorization in the CONSUMER_GROUP_DESCRIBE API, has been disclosed, but no PoC, exploit code, active exploitation, or patch information is included.
Some increased actor activities are shown targeting Apache Kafka (CVE-2026-41115) https://vuldb.com/vuln/367904/cti
Post summary
Threat actors are actively targeting Apache Kafka via CVE-2026-41115, but the post fails to provide exploit code, patch instructions, or technical vulnerability details.
『We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.』 CVE-2026-41115 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API https://kafka.apache.org/community/cve-list/#CVE-2026-41115
Post summary
Kafka users are advised to review ACLs to mitigate an improper authorization CVE; no PoC, exploit, or active use is reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | kafka | - | - | - |