CVE-2025-27818: Apache Kafka RCE Vulnerability

CVE-2025-27818 Overview

A critical insecure deserialization vulnerability has been identified in Apache Kafka that allows authenticated operators to achieve remote code execution through malicious LDAP response deserialization. The vulnerability exists in the SASL JAAS configuration handling of Kafka Connect, where an attacker with access to alterConfig permissions on the cluster resource or Kafka Connect worker can configure connectors to use the com.sun.security.auth.module.LdapLoginModule, redirecting connections to an attacker-controlled LDAP server that responds with malicious serialized Java objects.

Critical Impact

Authenticated attackers can achieve unrestricted deserialization of untrusted data leading to Remote Code Execution (RCE) on Kafka Connect servers when vulnerable gadget chains exist in the classpath.

Affected Products

• Apache Kafka versions from 2.0.0 through 3.9.0
• Apache Kafka Connect versions from 2.3.0 through 3.9.0
• Apache Kafka 4.0.0 releases prior to the security fix

Discovery Timeline

• 2025-06-10 - CVE CVE-2025-27818 published to NVD
• 2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-27818

Vulnerability Analysis

This vulnerability (CWE-502: Deserialization of Untrusted Data) enables remote code execution through a multi-stage attack chain targeting the SASL JAAS configuration mechanism in Apache Kafka. The flaw allows authenticated operators with connector configuration privileges to abuse the sasl.jaas.config property by specifying the LdapLoginModule as the authentication module. When Kafka Connect attempts to authenticate using this configuration, it connects to an attacker-specified LDAP server. The attacker's LDAP server responds with serialized Java objects that, when deserialized by the Kafka Connect process, can trigger arbitrary code execution if exploitable gadget chains exist in the application's classpath.

The vulnerability is particularly dangerous because since Apache Kafka 3.0.0, users are permitted to specify these SASL override properties in connector configurations for Kafka Connect clusters running with default configurations. Prior to version 3.0.0, exploitation required the cluster to be explicitly reconfigured with a connector client override policy that permits these properties.

Root Cause

The root cause lies in the insecure handling of LDAP responses during SASL authentication when using the LdapLoginModule. The Kafka Connect framework allows operators to configure the sasl.jaas.config property through multiple override mechanisms (producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config). When this property is set to use com.sun.security.auth.module.LdapLoginModule, the application deserializes LDAP responses without proper validation, creating a classic Java deserialization attack surface that can be exploited through gadget chains present in the classpath.

Attack Vector

The attack requires network access and low-privileged authentication to the Kafka cluster or Connect worker. An attacker exploits this vulnerability by:

1. Gaining authenticated access with permissions to create or modify connector configurations
2. Creating or modifying a connector configuration to set the sasl.jaas.config property to use LdapLoginModule with an attacker-controlled LDAP server URL
3. Waiting for the connector to attempt SASL authentication, triggering a connection to the malicious LDAP server
4. Responding from the malicious LDAP server with a serialized Java object containing a gadget chain
5. Achieving code execution when Kafka Connect deserializes the malicious response

The vulnerability can be triggered through the Kafka Connect REST API when configuring connectors, or through the AlterConfig command when modifying broker configurations directly.

Detection Methods for CVE-2025-27818

Indicators of Compromise

• Connector configurations containing sasl.jaas.config properties referencing LdapLoginModule or JndiLoginModule
• Outbound LDAP connections (port 389/636) from Kafka Connect workers to unexpected external IP addresses
• Connector configurations with producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config properties pointing to untrusted LDAP servers
• Unexpected Java process spawning or unusual network activity from Kafka Connect JVM processes

Detection Strategies

• Monitor Kafka Connect REST API logs for connector configuration changes involving sasl.jaas.config properties
• Implement network monitoring to detect and alert on outbound LDAP connections from Kafka infrastructure to non-whitelisted destinations
• Audit connector configurations periodically for suspicious JAAS login module references
• Deploy runtime application security monitoring to detect deserialization attacks and unusual class loading patterns

Monitoring Recommendations

• Enable detailed audit logging for Kafka Connect configuration changes through the REST API
• Implement egress filtering and monitoring for Kafka Connect workers to detect unauthorized LDAP connections
• Set up alerts for connector modifications that include SASL-related override properties
• Monitor for Java deserialization attack patterns in endpoint detection solutions

How to Mitigate CVE-2025-27818

Immediate Actions Required

• Upgrade Apache Kafka to version 3.9.1 or 4.0.0 or later, which includes default blocking of problematic login modules
• Validate all existing connector configurations and remove any untrusted LDAP configurations from sasl.jaas.config properties
• Examine connector dependencies for vulnerable versions and upgrade or remove affected connectors
• Implement network segmentation to restrict outbound LDAP connections from Kafka Connect workers

Patch Information

Apache has released security patches in Apache Kafka versions 3.9.1 and 4.0.0 that disable the problematic login modules by default. The fix introduces a system property (-Dorg.apache.kafka.disallowed.login.modules) that can be used to disable vulnerable login modules in SASL JAAS configurations. By default, com.sun.security.auth.module.JndiLoginModule and com.sun.security.auth.module.LdapLoginModule are now disabled in Apache Kafka Connect 3.9.1/4.0.0. For detailed patch information, refer to the Apache Kafka CVE List.

Workarounds

• Enable the disallowed login modules system property by adding -Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule to Kafka Connect startup parameters
• Implement a custom connector client config override policy to restrict which Kafka client properties can be overridden in connector configurations
• Restrict network egress from Kafka Connect workers to only allow connections to known, trusted Kafka brokers and schema registries
• Review and limit user permissions to only allow trusted operators to create or modify connector configurations

# Configuration example - Add to Kafka Connect startup script
export KAFKA_OPTS="-Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule"