{"answers":{"affected":"13 open source packages ship an affected version, including org.apache.kafka:kafka_2.12, kafka and org.apache.kafka:kafka_2.10. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-56128 in the wild and no public exploit code.","fix":"Upgrade org.apache.kafka:kafka_2.12 to a fixed version for your release line: 3.7.2 or 3.8.1.","what":"CVE-2024-56128 is a medium-severity authentication bypass vulnerability in Apache Kafka, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-56128 and fix it if it is affected.\n\nWhat it is: CVE-2024-56128 is a medium-severity authentication bypass vulnerability in Apache Kafka, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-56128 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.kafka:kafka_2.12 (Maven): affected from 0.10.2.0; fixed in 3.7.2\n- org.apache.kafka:kafka_2.12 (Maven): affected from 0.10.2.0; fixed in 3.7.2\n- org.apache.kafka:kafka_2.12 (Maven): affected from 3.8.0; fixed in 3.8.1\n- org.apache.kafka:kafka_2.12 (Maven): affected from 3.8.0; fixed in 3.8.1\n- kafka (Bitnami): affected from 3.8.0; fixed in 3.8.1, 3.7.2\n- org.apache.kafka:kafka_2.10 (Maven): affected from 0.10.2.0 up to 0.10.2.2; no fix listed\n- org.apache.kafka:kafka_2.10 (Maven): affected from 0.10.2.0 up to 0.10.2.2; no fix listed\n- org.apache.kafka:kafka_2.11 (Maven): affected from 0.10.2.0 up to 2.4.1; no fix listed\n- org.apache.kafka:kafka_2.11 (Maven): affected from 0.10.2.0 up to 2.4.1; no fix listed\n- org.apache.kafka:kafka_2.13 (Maven): affected from 0.10.2.0; fixed in 3.7.2\n- org.apache.kafka:kafka_2.13 (Maven): affected from 0.10.2.0; fixed in 3.7.2\n- org.apache.kafka:kafka_2.13 (Maven): affected from 3.8.0; fixed in 3.8.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-56128/ (Markdown: https://insights.sbomify.com/CVE-2024-56128/index.md)","id":"CVE-2024-56128","markdown":"https://insights.sbomify.com/CVE-2024-56128/index.md","name":"CVE-2024-56128","record":{"aliases":["BIT-kafka-2024-56128","GHSA-p7c9-8xx8-h74f","MINI-c57p-3hmh-4fg3","MINI-jxrg-gxh8-qxx8","ROOT-APP-MAVEN-CVE-2024-56128"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Kafka","requires_auth":"none","summary":"Attackers can bypass SCRAM authentication via replay attacks if Kafka is configured without TLS encryption, allowing unauthorized access.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"kafka","vendor":"apache"}],"cvss":{"score":5.3,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-303","name":"Incorrect Implementation of Authentication Algorithm"}],"description":"Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation.\n\nIssue Summary:\nApache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1].\nSpecifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message.\nHowever, Kafka's SCRAM implementation did not perform this validation.\n\nImpact:\nThis vulnerability is exploitable only when an attacker has plaintext access to the SCRAM authentication exchange. However, the usage of SCRAM over plaintext is strongly\ndiscouraged as it is considered an insecure practice [2]. Apache Kafka recommends deploying SCRAM exclusively with TLS encryption to protect SCRAM exchanges from interception [3].\nDeployments using SCRAM with TLS are not affected by this issue.\n\nHow to Detect If You Are Impacted:\nIf your deployment uses SCRAM authentication over plaintext communication channels (without TLS encryption), you are likely impacted.\nTo check if TLS is enabled, review your server.properties configuration file for listeners property. If you have SASL_PLAINTEXT in the listeners, then you are likely impacted.\n\nFix Details:\nThe issue has been addressed by introducing nonce verification in the final message of the SCRAM authentication exchange to ensure compliance with RFC 5802.\n\nAffected Versions:\nApache Kafka versions 0.10.2.0 through 3.9.0, excluding the fixed versions below.\n\nFixed Versions:\n3.9.0\n3.8.1\n3.7.2\n\nUsers are advised to upgrade to 3.7.2 or later to mitigate this issue.\n\nRecommendations for Mitigation:\nUsers unable to upgrade to the fixed versions can mitigate the issue by:\n- Using TLS with SCRAM Authentication:\nAlways deploy SCRAM over TLS to encrypt authentication exchanges and protect against interception.\n- Considering Alternative Authentication Mechanisms:\nEvaluate alternative authentication mechanisms, such as PLAIN, Kerberos or OAuth with TLS, which provide additional layers of security.","ecosystems":["Bitnami","Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption","id":"CVE-2024-56128","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"auth_bypass","year":"2024"},"n_packages":13,"n_references":4,"next":{"headline":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","id":"CVE-2024-56131"},"packages":[{"ecosystem":"Bitnami","fixed":["3.8.1","3.7.2"],"introduced":["3.8.0","0.10.2"],"last_affected":[],"package":"kafka","purl":"pkg:bitnami/kafka","source":"BIT-kafka-2024-56128"},{"ecosystem":"Maven","fixed":[],"introduced":["0.10.2.0"],"last_affected":["0.10.2.2"],"package":"org.apache.kafka:kafka_2.10","purl":null,"source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":[],"introduced":["0.10.2.0"],"last_affected":["0.10.2.2"],"package":"org.apache.kafka:kafka_2.10","purl":"pkg:maven/org.apache.kafka/kafka_2.10","source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":[],"introduced":["0.10.2.0"],"last_affected":["2.4.1"],"package":"org.apache.kafka:kafka_2.11","purl":null,"source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":[],"introduced":["0.10.2.0"],"last_affected":["2.4.1"],"package":"org.apache.kafka:kafka_2.11","purl":"pkg:maven/org.apache.kafka/kafka_2.11","source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.7.2"],"introduced":["0.10.2.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.12","purl":null,"source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.7.2"],"introduced":["0.10.2.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.12","purl":"pkg:maven/org.apache.kafka/kafka_2.12","source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.8.1"],"introduced":["3.8.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.12","purl":null,"source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.8.1"],"introduced":["3.8.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.12","purl":"pkg:maven/org.apache.kafka/kafka_2.12","source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.7.2"],"introduced":["0.10.2.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.13","purl":null,"source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.7.2"],"introduced":["0.10.2.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.13","purl":"pkg:maven/org.apache.kafka/kafka_2.13","source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.8.1"],"introduced":["3.8.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.13","purl":null,"source":"GHSA-p7c9-8xx8-h74f"},{"ecosystem":"Maven","fixed":["3.8.1"],"introduced":["3.8.0"],"last_affected":[],"package":"org.apache.kafka:kafka_2.13","purl":"pkg:maven/org.apache.kafka/kafka_2.13","source":"GHSA-p7c9-8xx8-h74f"}],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2024-56123"},"products":["Apache Kafka"],"published":"2024-12-18","related":[{"cvss_score":9.1,"headline":"Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication","id":"CVE-2026-33557","kev_date_added":null,"published":"2026-04-20"},{"cvss_score":8.8,"headline":"Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration","id":"CVE-2025-27818","kev_date_added":null,"published":"2025-06-10"},{"cvss_score":8.8,"headline":"Improper Input Validation in Apache Kafka","id":"CVE-2018-17196","kev_date_added":null,"published":"2019-07-11"},{"cvss_score":8.7,"headline":"Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition","id":"CVE-2026-35554","kev_date_added":null,"published":"2026-04-07"},{"cvss_score":7.5,"headline":"Apache Kafka Client: Arbitrary file read and SSRF vulnerability","id":"CVE-2025-27817","kev_date_added":null,"published":"2025-06-10"},{"cvss_score":7.5,"headline":"Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration","id":"CVE-2025-27819","kev_date_added":null,"published":"2025-06-10"},{"cvss_score":7.5,"headline":"Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers","id":"CVE-2022-34917","kev_date_added":null,"published":"2022-09-20"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-12-18","vendors":["Apache Software Foundation"]},"summary":"Attackers can bypass SCRAM authentication via replay attacks if Kafka is configured without TLS encryption, allowing unauthorized access.","url":"https://insights.sbomify.com/CVE-2024-56128/"}