Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-41115: Apache Kafka may expose group metadata to unauthorized users
CVE-2026-41115 · published 5 months ago
Summary
The CONSUMER_GROUP_DESCRIBE function in Apache Kafka checks the wrong permission, which could let users see group details they shouldn't. This may happen if access control lists are not set tightly. Review and tighten your Kafka group permissions to grant only the minimum needed access.
What to do
- Update kafka to version 4.3.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | kafka |
>= 4.0.0, < 4.3.1 Fix: upgrade to 4.3.1
|
| – | apache | kafka |
>= 4.0.0, <= 4.3.0 cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:* |
Original advisory text
Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
An improper authorization vulnerability has been identified in Apache Kafka.
The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
References
- http://www.openwall.com/lists/oss-security/2026/06/02/5 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-41115 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41115... Vendor Advisory
- https://kafka.apache.org/cve-list Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.3
Medium
Type
CWE-285Improper Authorization
Timeline
Published2 Jun 2026
Updated3 Nov 2026
First seen2 Jun 2026
Track software like this
Free during beta