CVE-2023-25194: Apache Kafka Connect JNDI login module deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with low attack complexity and high confidentiality, integrity and availability impact, plus an EPSS score near the top percentile, though it requires an authenticated operator with connector management rights.

What it is

Kafka Connect lets an authenticated operator set the sasl.jaas.config property on a connector's Kafka clients to com.sun.security.auth.module.JndiLoginModule via producer/consumer/admin override properties. The worker then connects to an attacker-controlled LDAP server and deserializes the response, enabling Java deserialization gadget chains. It matters because this turns a legitimate connector-management feature into remote code execution on the Connect worker.

Impact

An attacker with access to a Kafka Connect worker and permission to create or modify connectors can execute arbitrary code on the Connect server when suitable gadgets exist on the classpath. This compromises the worker and any credentials or data it handles.

Attack surface

Reached over the network through the Kafka Connect REST API by an authenticated operator who can create or modify connectors; no user interaction is required. Since Kafka 3.0.0 these override properties are accepted in out-of-the-box configurations, while before 3.0.0 they require a permissive connector client override policy.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.9581, 99.87th percentile), indicating strong likelihood of exploitation activity. References are vendor advisories and mitigation guidance rather than public exploit write-ups.

What to do

• Upgrade Apache Kafka Connect to 3.4.0 or later, where com.sun.security.auth.module.JndiLoginModule is disabled by default.
• Set the -Dorg.apache.kafka.disallowed.login.modules system property to block JndiLoginModule on versions that support it.
• Implement a connector client config override policy that restricts which Kafka client properties, including sasl.jaas.config overrides, connectors may set.
• Validate connector configurations and allow only trusted JNDI configurations; review connector dependencies for vulnerable versions and upgrade or remove them.
• Restrict who can create or modify connectors through the Kafka Connect REST API and limit network reachability of the Connect worker.

Detection

• Monitor Kafka Connect REST API calls that create or modify connectors containing sasl.jaas.config with JndiLoginModule or producer/consumer/admin override properties.
• Alert on outbound LDAP connections from Kafka Connect workers to unexpected or external hosts.
• Audit connector configurations for override properties and untrusted JNDI settings, and review worker logs for JNDI or deserialization errors.
• Track connector dependency versions for known vulnerable libraries that could supply deserialization gadgets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.