CVE-2025-27817

Apache Kafka Clients contain an unrestricted URL handling flaw (SSRF, CWE-918) in the SASL/OAUTHBEARER settings 'sasl.oauthbearer.token.endpoint.url' and 'sasl.oauthbearer.jwks.endpoint.url', which also permits arbitrary file reads whose contents can surface in error logs. It is triggered when an application allows an untrusted party to supply Kafka client configuration: the attacker points these URL settings at local files or internal endpoints to read disk contents and environment variables, or makes requests to unintended internal locations. The attacker gains unauthorized disclosure of sensitive files, credentials, and access to internal network endpoints; in Kafka Connect this enables escalation from REST API access to filesystem, environment, and URL access, a notable risk for multi-tenant SaaS environments. Any deployment running affected Kafka client versions where configuration can be attacker-influenced is exposed, with Kafka Connect users a priority audience; fixes introduce the '-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls' system property in 3.9.1 (still allows all URLs by default for backward compatibility) and in 4.0.0 (empty allowlist by default). No public PoC, CISA KEV listing, or confirmed in-the-wild exploitation is known, but the 65.9% EPSS score (99th percentile) indicates an elevated probability of near-term exploitation.

What to do: Upgrade Kafka clients to 4.0.0 or later and explicitly set -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls to the broker/identity-provider endpoints you use; if upgrading to 3.9.1 instead, set the same property, since it still allows all URLs by default. Audit whether any untrusted party (tenants, connector submitters, REST API users) can supply Kafka client configuration, and restrict access to the Kafka Connect REST API (default port 8083).