CVE-2025-27819

What it actually does

The vulnerability permits remote code execution or denial of service via deserialization of attacker-controlled data in the SASL JAAS JndiLoginModule configuration on Apache Kafka brokers when the attacker possesses AlterConfigs permission on the cluster resource.

Why it matters to the business

Successful exploitation can lead to arbitrary code execution on brokers or service disruption, resulting in potential data exposure, messaging system outages, and infrastructure compromise; the low EPSS and lack of KEV listing indicate limited observed exploitation but the flaw affects core messaging infrastructure.

How an attack unfolds

An attacker first connects to the Kafka cluster and obtains AlterConfigs permission on the cluster resource, then modifies the broker JAAS configuration to reference a malicious JndiLoginModule pointing to an attacker-controlled directory service; triggering authentication causes a JNDI lookup that deserializes untrusted data to achieve RCE or DoS.

How to fix it

Upgrade Apache Kafka to 3.9.1 or 4.0.0 where com.sun.security.auth.module.JndiLoginModule and LdapLoginModule are disabled by default, or to at least 3.4.0 and set the system property -Dorg.apache.kafka.disallowed.login.modules to block problematic modules; apply the listed fixed versions for affected Android DownloadProvider packages.

How to confirm the fix worked

Verify the system property org.apache.kafka.disallowed.login.modules is set and contains the JndiLoginModule entries, confirm broker JAAS configurations no longer reference JndiLoginModule or LdapLoginModule, and test that AlterConfigs changes cannot introduce disallowed login modules.

Typical attack path

1. Establish network connection to the Kafka cluster
2. Acquire AlterConfigs permission on the cluster resource
3. Use AlterConfigs to inject a malicious JAAS login module referencing JNDI
4. Trigger authentication or configuration reload to initiate JNDI lookup and deserialization
5. Execute arbitrary code or cause denial of service on the broker

How to detect it

Inspect Kafka broker audit and authentication logs for unexpected AlterConfigs operations on the cluster resource and any JAAS configuration changes that reference JndiLoginModule or external directory services.

What your security team should do

• Immediately restrict AlterConfigs permissions to only trusted administrative principals
• Apply the fixed versions listed for each affected Android DownloadProvider package or upgrade Kafka to 3.9.1/4.0.0
• Enable the disallowed login modules system property on all brokers
• Monitor for unauthorized configuration changes using audit logs
• Review and harden SASL JAAS configurations across the environment