CVE-2025-27817

Deeper analysis

A possible arbitrary file read and SSRF vulnerability exists in Apache Kafka Clients. The issue stems from the client's acceptance of unvalidated configuration values for SASL/OAUTHBEARER connections, specifically the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" properties. When these values are supplied by an untrusted party, the client can be directed to read arbitrary local files (including environment variables) or issue requests to unintended network locations, with the retrieved content surfaced in error logs. The flaw is particularly relevant to Apache Kafka Connect deployments where configuration can be supplied through the REST API.

An attacker with the ability to influence Kafka client configuration—such as through a compromised or multi-tenant Connect deployment—can leverage the properties to obtain filesystem contents or perform SSRF. This grants access to sensitive data on disk or environment variables and may allow requests to internal services that would otherwise be unreachable. The CVSS 7.5 score reflects network-exploitable confidentiality impact without authentication or user interaction.

Advisories from the Apache Kafka project and the oss-security mailing list describe the addition of the system property "-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls" starting in versions 3.9.1 and 4.0.0. Version 3.9.1 retains permissive defaults for backward compatibility, while 4.0.0 and later default to an empty allow list, requiring explicit configuration of permitted endpoints.

The EPSS score rose from lower values after disclosure to a peak of 0.2509 on 2026-05-05 before receding to the current 0.2142, indicating measurable post-publication exploitation interest.