8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-27819

CVE-2025-27819: Apache Kafka Deserialization of Untrusted Data vulnerability

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.

Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-27819

CVE-2025-27819:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.kafka:kafka	maven	< 3.4.0	3.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-27819 allows an attacker with AlterConfigs permission on an Apache Kafka cluster to achieve Remote Code Execution (RCE) or Denial of Service (DoS). This is accomplished by setting a malicious SASL JAAS configuration that utilizes the 'com.sun.security.auth.module.JndiLoginModule'.

The root cause is that Kafka brokers, in versions prior to 3.4.0, did not adequately restrict which JAAS login modules could be configured and used. Specifically, the mechanism for parsing the 'sasl.jaas.config' property and preparing it for the Java LoginContext did not filter out or disallow known dangerous modules like JndiLoginModule.

The primary Kafka function involved in this vulnerable processing is 'org.apache.kafka.common.security.JaasConfig.getAppConfigurationEntry(String name)'. This method is part of Kafka's custom implementation of 'javax.security.auth.login.Configuration'. It takes a JAAS application name (e.g., 'KafkaServer') and returns the configured 'AppConfigurationEntry' objects. These entries dictate which login modules are instantiated and used by 'LoginContext' for authentication.

In a vulnerable scenario:

An attacker uses the 'AlterConfigs' API to set the 'sasl.jaas.config' property for a broker to use 'com.sun.security.auth.module.JndiLoginModule' with parameters pointing to a malicious JNDI server.
When the Kafka broker needs to establish or refresh a SASL context, it will use its 'JaasConfig' implementation.
The 'LoginContext' will call 'JaasConfig.getAppConfigurationEntry()' to get the configuration.
In vulnerable versions, this method would parse the malicious configuration and return an 'AppConfigurationEntry' for 'JndiLoginModule' without any validation against a disallow list.
'LoginContext' then instantiates 'JndiLoginModule', which, upon its 'login()' method execution, performs the JNDI lookup specified in its configuration, leading to RCE or DoS.

The fix, introduced in Kafka 3.4.0, added a system property 'org.apache.kafka.disallowed.login.modules'. The 'JaasConfig.getAppConfigurationEntry' method (or its internal helpers) was modified to check module names against this list, preventing the instantiation of disallowed modules like 'JndiLoginModule' by default. This function is a key runtime indicator as it's directly involved in processing the malicious configuration that triggers the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.