CVE-2026-41115 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
Misconfigured ACLs in Apache Kafka allow unauthorized users to access sensitive consumer group metadata due to documentation discrepancies regarding required permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41115?
CVE-2026-41115 is a medium-severity missing authorization vulnerability in Apache Kafka, published on 2 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An improper authorization vulnerability has been identified in Apache Kafka.
The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
Weakness: CWE-285
Which versions are affected by CVE-2026-41115?
1 open source package ship an affected version, including kafka. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kafka Bitnami | From 4.0.0 | 4.3.1 |
Products include Apache Kafka.
How do I fix CVE-2026-41115?
Upgrade kafka to 4.3.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41115 being exploited?
There is no known exploitation of CVE-2026-41115 in the wild and no public exploit code.
Other vulnerabilities in Apache Kafka
- CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
- CVE-2025-27818 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration
- CVE-2018-17196 Improper Input Validation in Apache Kafka
- CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
- CVE-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability
Sources
Also known as BIT-kafka-2026-41115, GHSA-p5r3-m3w4-4fj6, MINI-47f9-7442-wq3q, MINI-r8jv-vrwv-rf79.