CVE-2025-27818

What it actually does

Authenticated users with alterConfig access can set connector client SASL JAAS overrides to com.sun.security.auth.module.LdapLoginModule, causing the Kafka Connect worker to connect to an attacker-controlled LDAP server and deserialize the response, enabling arbitrary Java deserialization gadget chains and potential RCE when gadgets are present in the classpath.

Why it matters to the business

Attackers with limited cluster privileges can achieve remote code execution on Kafka Connect workers, leading to potential cluster compromise, data exfiltration, or service disruption; the issue affects clusters since Kafka 2.0.0 / Connect 2.3.0 and is more easily triggered on versions 3.0.0 and later without custom policies.

How an attack unfolds

An attacker with alterConfig rights on the cluster or Connect worker creates or modifies a connector, supplying producer/consumer/admin override properties that set sasl.jaas.config to LdapLoginModule pointing at a malicious LDAP server; the server then returns a serialized object that triggers deserialization gadgets on the Connect worker, resulting in code execution.

How to fix it

Upgrade to Apache Kafka 3.9.1 or 4.0.0 (or later) where LdapLoginModule and JndiLoginModule are disabled by default via the org.apache.kafka.disallowed.login.modules system property; implement a custom connector client override policy to block the three override.sasl.jaas.config properties; validate all existing connector configurations and remove or replace any using untrusted LDAP settings; examine and upgrade connector dependencies that may contain deserialization gadgets.

How to confirm the fix worked

Confirm the disallowed.login.modules system property is set and contains com.sun.security.auth.module.LdapLoginModule; audit connector configurations via the REST API for any occurrence of the three override.sasl.jaas.config properties or the LdapLoginModule class name; verify that a connector client override policy is active and rejects these properties.

Typical attack path

1. Obtain alterConfig privileges on the Kafka cluster or Connect worker
2. Create or update a connector via the REST API supplying producer.override.sasl.jaas.config (or consumer/admin equivalents) that references com.sun.security.auth.module.LdapLoginModule against an attacker LDAP endpoint
3. Trigger connector task startup so the worker performs the LDAP bind and deserializes the malicious response
4. Execute gadget chain to achieve RCE on the Connect worker

How to detect it

Search Kafka Connect worker logs and connector configuration history for the strings producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, admin.override.sasl.jaas.config or com.sun.security.auth.module.LdapLoginModule; review audit logs for recent connector creations or updates performed by non-admin identities; inspect heap dumps or process command lines for the disallowed.login.modules property on running workers.

• producer.override.sasl.jaas.config
• consumer.override.sasl.jaas.config
• admin.override.sasl.jaas.config
• com.sun.security.auth.module.LdapLoginModule
• org.apache.kafka.disallowed.login.modules

What your security team should do

• Immediately upgrade all Kafka Connect clusters to 3.9.1/4.0.0 or later
• Deploy a connector client override policy that blocks sasl.jaas.config overrides
• Scan existing connectors for LdapLoginModule or JndiLoginModule usage and remediate
• Review alterConfig role assignments and apply least privilege
• Monitor for new connector creations that include the three override properties