CVE-2025-27817: apache software foundation apache kafka client Server-Side Request Forgery (SSRF)

CVSS: 7.5v3.1HighAnalyzed

AliasesCGA-25fm-jgjm-m3rjCGA-27vj-8f37-j4xwCGA-2hc8-6vh3-crww+241 more

Published 10-06-2025Last modified 10-06-2025

Vulnerability summary

CVE-2025-27817 is a high (CVSS 7.5) Server-Side Request Forgery (SSRF) vulnerability in apache software foundation apache kafka client. EPSS estimates a 68.78% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.

Overall risk

44/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

68.78%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 7

CGA-2MMF-PGV2-355P CGA-5P25-CM25-FWHQ CGA-H3GG-9463-WVJX CGA-HPW8-2779-R2PW CGA-M9CG-V9CH-86QX CGA-V372-CQ2C-RVFQ+1 more

Timeline

10-06-2025
PublishedVulnerability first disclosed.
10-06-2025
Last modifiedVulnerability information updated.

Description

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.

CVSS metrics

6 scores · 5 sources · 2 versions

v4.08.6v3.17.5

EPSS trend

Probability

68.78%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 68.78% on 18-09-2026

18-09-202618-10-2026

EPSS score

68.78%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Chainguard121 products

apache-nifi< 2.4.0-r4
apache-nifi-compat< 2.4.0-r4
apache-nifi-toolkit< 2.4.0-r4
apicurio-registry< 3.0.9-r1
apicurio-registry-nginx-config< 3.0.9-r1

apicurio-registry-ui< 3.0.9-r1
druid< 33.0.0-r4
druid-compat< 33.0.0-r4
hadoop-fips-3.4.2All versions (No fix recorded)
kafka_exporter-strimzi-compat< 0.46.0-r6
kafka-3.7All versions (No fix recorded)
kafka-3.8All versions (No fix recorded)
kafka-strimzi-compat< 0.46.0-r6
knative-kafka-broker-1.17-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.17-receiver-loomAll versions (No fix recorded)
logstash-8-with-output-opensearch< 8.18.2-r2
opensearch-2< 2.19.1-r5
opensearch-2-alerting< 2.19.1-r5
opensearch-2-analysis-icu< 2.19.1-r5
opensearch-2-analysis-kuromoji< 2.19.1-r5
opensearch-2-analysis-nori< 2.19.1-r5
opensearch-2-analysis-phonetic< 2.19.1-r5
opensearch-2-analysis-smartcn< 2.19.1-r5
opensearch-2-analysis-stempel< 2.19.1-r5
opensearch-2-analysis-ukrainian< 2.19.1-r5
opensearch-2-anomaly-detection< 2.19.1-r5
opensearch-2-asynchronous-search< 2.19.1-r5
opensearch-2-cross-cluster-replication< 2.19.1-r5
opensearch-2-crypto-kms< 2.19.1-r5
opensearch-2-custom-codecs< 2.19.1-r5
opensearch-2-discovery-azure-classic< 2.19.1-r5
opensearch-2-discovery-ec2< 2.19.1-r5
opensearch-2-discovery-gce< 2.19.1-r5
opensearch-2-entrypoint-compat< 2.19.1-r5
opensearch-2-geospatial< 2.19.1-r5
opensearch-2-identity-shiro< 2.19.1-r5
opensearch-2-index-management< 2.19.1-r5
opensearch-2-ingest-attachment< 2.19.1-r5
opensearch-2-job-scheduler< 2.19.1-r5
opensearch-2-k-nn< 2.19.1-r5
opensearch-2-mapper-annotated-text< 2.19.1-r5
opensearch-2-mapper-murmur3< 2.19.1-r5
opensearch-2-mapper-size< 2.19.1-r5
opensearch-2-ml-commons< 2.19.1-r5
opensearch-2-neural-search< 2.19.1-r5
opensearch-2-notifications< 2.19.1-r5
opensearch-2-observability< 2.19.1-r5
opensearch-2-performance-analyzer< 2.19.1-r5
opensearch-2-reporting< 2.19.1-r5
opensearch-2-repository-azure< 2.19.1-r5
opensearch-2-repository-gcs< 2.19.1-r5
opensearch-2-repository-s3< 2.19.1-r5
opensearch-2-security< 2.19.1-r5
opensearch-2-security-analytics< 2.19.1-r5
opensearch-2-sql< 2.19.1-r5
opensearch-2-store-smb< 2.19.1-r5
opensearch-2-telemetry-otel< 2.19.1-r5
opensearch-2-transport-nio< 2.19.1-r5
opensearch-3< 3.0.0-r2
opensearch-3-alerting< 3.0.0-r2
opensearch-3-analysis-icu< 3.0.0-r2
opensearch-3-analysis-kuromoji< 3.0.0-r2
opensearch-3-analysis-nori< 3.0.0-r2
opensearch-3-analysis-phonetic< 3.0.0-r2
opensearch-3-analysis-smartcn< 3.0.0-r2
opensearch-3-analysis-stempel< 3.0.0-r2
opensearch-3-analysis-ukrainian< 3.0.0-r2
opensearch-3-anomaly-detection< 3.0.0-r2
opensearch-3-asynchronous-search< 3.0.0-r2
opensearch-3-cross-cluster-replication< 3.0.0-r2
opensearch-3-crypto-kms< 3.0.0-r2
opensearch-3-custom-codecs< 3.0.0-r2
opensearch-3-discovery-azure-classic< 3.0.0-r2
opensearch-3-discovery-ec2< 3.0.0-r2
opensearch-3-discovery-gce< 3.0.0-r2
opensearch-3-geospatial< 3.0.0-r2
opensearch-3-index-management< 3.0.0-r2
opensearch-3-ingest-attachment< 3.0.0-r2
opensearch-3-job-scheduler< 3.0.0-r2
opensearch-3-k-nn< 3.0.0-r2
opensearch-3-mapper-annotated-text< 3.0.0-r2
opensearch-3-mapper-murmur3< 3.0.0-r2
opensearch-3-mapper-size< 3.0.0-r2
opensearch-3-ml-commons< 3.0.0-r2
opensearch-3-neural-search< 3.0.0-r2
opensearch-3-notifications< 3.0.0-r2
opensearch-3-observability< 3.0.0-r2
opensearch-3-performance-analyzer< 3.0.0-r2
opensearch-3-reporting< 3.0.0-r2
opensearch-3-repository-azure< 3.0.0-r2
opensearch-3-repository-gcs< 3.0.0-r2
opensearch-3-repository-s3< 3.0.0-r2
opensearch-3-security< 3.0.0-r2
opensearch-3-security-analytics< 3.0.0-r2
opensearch-3-sql< 3.0.0-r2
opensearch-3-store-smb< 3.0.0-r2
opensearch-3-telemetry-otel< 3.0.0-r2
prometheus-jmx-exporter-strimzi-compat< 0.46.0-r6
strimzi-kafka-operator< 0.46.0-r6
strimzi-kafka-operator-cluster-operator< 0.46.0-r6
strimzi-kafka-operator-kafka-agent< 0.46.0-r6
strimzi-kafka-operator-kafka-base< 0.46.0-r6
strimzi-kafka-operator-kafka-init< 0.46.0-r6
strimzi-kafka-operator-kafka-thirdparty-libs< 0.46.0-r6
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.46.0-r6
strimzi-kafka-operator-topic-operator< 0.46.0-r6
strimzi-kafka-operator-tracing-agent< 0.46.0-r6
strimzi-kafka-operator-user-operator< 0.46.0-r6
thingsboard< 4.0.1-r6
thingsboard-tb-js-executor< 4.0.1-r6
thingsboard-tb-mqtt-transport< 4.0.1-r6
thingsboard-tb-node< 4.0.1-r6
thingsboard-tb-web-ui< 4.0.1-r6
wildfly< 36.0.1-r5
wildfly-openjdk-17< 36.0.1-r5
wildfly-openjdk-17-compat< 36.0.1-r5
wildfly-openjdk-21< 36.0.1-r5
wildfly-openjdk-21-compat< 36.0.1-r5
zipkin< 3.5.1-r2
zipkin-oci-entrypoint< 3.5.1-r2
zipkin-slim< 3.5.1-r2

Show all 121

Wolfi75 products

apache-nifi< 2.4.0-r4
apache-nifi-compat< 2.4.0-r4
apache-nifi-toolkit< 2.4.0-r4
apicurio-registry< 3.0.9-r1
apicurio-registry-nginx-config< 3.0.9-r1

apicurio-registry-ui< 3.0.9-r1
druid< 33.0.0-r4
druid-compat< 33.0.0-r4
kafka_exporter-strimzi-compat< 0.46.0-r6
kafka-strimzi-compat< 0.46.0-r6
logstash-8-with-output-opensearch< 8.18.2-r2
opensearch-2< 2.19.1-r5
opensearch-3< 3.0.0-r2
opensearch-3-alerting< 3.0.0-r2
opensearch-3-analysis-icu< 3.0.0-r2
opensearch-3-analysis-kuromoji< 3.0.0-r2
opensearch-3-analysis-nori< 3.0.0-r2
opensearch-3-analysis-phonetic< 3.0.0-r2
opensearch-3-analysis-smartcn< 3.0.0-r2
opensearch-3-analysis-stempel< 3.0.0-r2
opensearch-3-analysis-ukrainian< 3.0.0-r2
opensearch-3-anomaly-detection< 3.0.0-r2
opensearch-3-asynchronous-search< 3.0.0-r2
opensearch-3-cross-cluster-replication< 3.0.0-r2
opensearch-3-crypto-kms< 3.0.0-r2
opensearch-3-custom-codecs< 3.0.0-r2
opensearch-3-discovery-azure-classic< 3.0.0-r2
opensearch-3-discovery-ec2< 3.0.0-r2
opensearch-3-discovery-gce< 3.0.0-r2
opensearch-3-geospatial< 3.0.0-r2
opensearch-3-index-management< 3.0.0-r2
opensearch-3-ingest-attachment< 3.0.0-r2
opensearch-3-job-scheduler< 3.0.0-r2
opensearch-3-k-nn< 3.0.0-r2
opensearch-3-mapper-annotated-text< 3.0.0-r2
opensearch-3-mapper-murmur3< 3.0.0-r2
opensearch-3-mapper-size< 3.0.0-r2
opensearch-3-ml-commons< 3.0.0-r2
opensearch-3-neural-search< 3.0.0-r2
opensearch-3-notifications< 3.0.0-r2
opensearch-3-observability< 3.0.0-r2
opensearch-3-performance-analyzer< 3.0.0-r2
opensearch-3-reporting< 3.0.0-r2
opensearch-3-repository-azure< 3.0.0-r2
opensearch-3-repository-gcs< 3.0.0-r2
opensearch-3-repository-s3< 3.0.0-r2
opensearch-3-security< 3.0.0-r2
opensearch-3-security-analytics< 3.0.0-r2
opensearch-3-sql< 3.0.0-r2
opensearch-3-store-smb< 3.0.0-r2
opensearch-3-telemetry-otel< 3.0.0-r2
prometheus-jmx-exporter-strimzi-compat< 0.46.0-r6
strimzi-kafka-operator< 0.46.0-r6
strimzi-kafka-operator-cluster-operator< 0.46.0-r6
strimzi-kafka-operator-kafka-agent< 0.46.0-r6
strimzi-kafka-operator-kafka-base< 0.46.0-r6
strimzi-kafka-operator-kafka-init< 0.46.0-r6
strimzi-kafka-operator-kafka-thirdparty-libs< 0.46.0-r6
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.46.0-r6
strimzi-kafka-operator-topic-operator< 0.46.0-r6
strimzi-kafka-operator-tracing-agent< 0.46.0-r6
strimzi-kafka-operator-user-operator< 0.46.0-r6
thingsboard< 4.0.1-r6
thingsboard-tb-js-executor< 4.0.1-r6
thingsboard-tb-mqtt-transport< 4.0.1-r6
thingsboard-tb-node< 4.0.1-r6
thingsboard-tb-web-ui< 4.0.1-r6
wildfly< 36.0.1-r5
wildfly-openjdk-17< 36.0.1-r5
wildfly-openjdk-17-compat< 36.0.1-r5
wildfly-openjdk-21< 36.0.1-r5
wildfly-openjdk-21-compat< 36.0.1-r5
zipkin< 3.5.1-r2
zipkin-oci-entrypoint< 3.5.1-r2
zipkin-slim< 3.5.1-r2

Show all 75

Apache1 product

kafka≥ 3.1.0, < 3.9.1

Apache software foundation1 product

apache kafka client≥ 3.1.0, ≤ 3.9.0

Org.apache.kafka1 product

kafka-clients≥ 3.1.0, < 3.9.1

5 vendors · 199 products

References

5 links

kafka.apache.org/cve-listVendor AdvisoryAdvisoryWEB
www.openwall.com/lists/oss-security/2025/06/09/1WEBMailing ListThird Party Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27817.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-27817Advisory
github.com/apache/kafkaPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities