CVE-2025-27817: Apache Kafka Client arbitrary file read and SSRF via SASL/OAUTHBEARER URLs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability, no privileges or interaction, high confidentiality impact, and very high EPSS despite no KEV listing.

What it is

Apache Kafka Clients accept SASL/OAUTHBEARER configuration values such as sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, and use them without restricting the target. When an untrusted party can set client configuration, these values can point at local files or arbitrary URLs, causing file contents or environment variables to be returned in error logs or requests to be sent to unintended locations. This matters because Kafka Connect can turn REST API access into filesystem, environment and URL access, which is risky in shared and SaaS environments.

Impact

An attacker gains read access to arbitrary files and environment variables on the host, and can make the Kafka client issue requests to attacker-chosen or internal locations. In Kafka Connect this can escalate from REST API access to filesystem and environment disclosure.

Attack surface

Reached over the network through Kafka client configuration, including Kafka Connect's REST API, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires that an untrusted party can influence the SASL/OAUTHBEARER endpoint URL settings.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.688 (99.3rd percentile), indicating elevated likelihood of attempted exploitation. References are vendor advisory and mailing list only, with no public exploit or in-the-wild tag.

What to do

• Upgrade to Apache Kafka 3.9.1 or 4.0.0 and newer; on 4.0.0+ the allowed URL list defaults to empty and must be set explicitly.
• Set the system property -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls to the exact trusted OAuth/JWKS endpoints in use.
• Do not allow untrusted parties to supply Kafka client SASL/OAUTHBEARER configuration, especially via Kafka Connect REST API.
• Restrict Kafka Connect REST API access to trusted networks and authenticated administrators.
• Review existing client and connector configurations for unexpected sasl.oauthbearer.token.endpoint.url or sasl.oauthbearer.jwks.endpoint.url values.

Detection

• Search Kafka client and Connect logs for error entries containing file contents or environment variable values returned from OAuth/JWKS endpoint resolution.
• Monitor outbound network connections from Kafka clients and Connect workers to unexpected hosts, including internal metadata or loopback addresses.
• Audit Kafka Connect REST API calls that create or modify connector configurations containing sasl.oauthbearer.* URL settings.
• Alert on configuration changes that set sasl.oauthbearer.token.endpoint.url or sasl.oauthbearer.jwks.endpoint.url to file:// or non-approved hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.