CVE-2026-41727: Spring Kafka Header Injection Vulnerability

CVE-2026-41727 Overview

CVE-2026-41727 affects Spring for Apache Kafka's retry topic infrastructure. The framework does not sufficiently validate user-controlled header values before acting on them. A producer can send a record with a crafted retry_topic-attempts header containing an out-of-range attempt count. The retry topic router then misidentifies the message's position in the retry sequence.

The issue is classified as improper input validation [CWE-20] and affects multiple supported branches of Spring for Apache Kafka.

Critical Impact
An attacker with the ability to produce Kafka records can manipulate retry sequencing, leading to availability impact on consumers that rely on the retry topic infrastructure.

Affected Products

Spring for Apache Kafka 4.0.0 through 4.0.5
Spring for Apache Kafka 3.3.0 through 3.3.15 and 3.2.0 through 3.2.13
Spring for Apache Kafka 2.9.0 through 2.9.13 and 2.8.0 through 2.8.11

Discovery Timeline

2026-06-10 - CVE-2026-41727 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41727

Vulnerability Analysis

Spring for Apache Kafka provides a retry topic mechanism that automatically routes failed messages through a sequence of retry topics before moving them to a dead-letter topic. The framework tracks retry progression using Kafka record headers, including retry_topic-attempts, which encodes the current attempt count.

The retry topic router reads this header value and uses it to decide the next retry destination. Because the header originates from the producer side, an attacker who can publish to a topic consumed by a Spring Kafka listener can supply arbitrary values. The router does not enforce that the attempt count falls within the expected range for the configured retry policy.

When the router processes an out-of-range value, it misidentifies the message's position in the retry sequence. This causes incorrect routing decisions, can short-circuit the retry policy, or trigger error paths that disrupt consumer availability.

Root Cause

The root cause is missing validation of the retry_topic-attempts header before the value is consumed by routing logic. The framework treats producer-supplied metadata as trustworthy rather than constraining the value to the bounds defined by the configured retry policy.

Attack Vector

Exploitation requires network access and low privileges sufficient to produce records to a Kafka topic monitored by a vulnerable Spring Kafka consumer. The attacker crafts a record that includes a malicious retry_topic-attempts header with a value outside the legitimate range. No user interaction is required, and the result is an availability impact on the consumer application.

The vulnerability mechanism is documented in the Spring Security Advisory CVE-2026-41727.

Detection Methods for CVE-2026-41727

Indicators of Compromise

Kafka records arriving on consumer topics with retry_topic-attempts header values that fall outside the configured maxAttempts range for the retry topic configuration.
Unexpected routing to dead-letter topics or skipped retry stages for messages produced by sources that should not set retry headers.
Consumer error logs referencing the retry topic router and array or index conditions when processing inbound headers.

Detection Strategies

Inspect Kafka headers at the broker or interceptor layer and alert on records containing retry_topic-attempts originating from producers that are not the Spring Kafka framework itself.
Compare observed header values against the configured retry policy bounds and flag anomalies.
Correlate producer identity (client.id, principal) with header presence to identify external producers injecting retry metadata.

Monitoring Recommendations

Enable broker-side audit logging of producer principals writing to consumer-facing topics and review for unauthorized identities.
Track metrics on retry topic message flow and alert on sudden shifts between retry stages or dead-letter routing.
Monitor Spring Kafka consumer logs for routing exceptions tied to the retry topic infrastructure.

How to Mitigate CVE-2026-41727

Immediate Actions Required

Upgrade Spring for Apache Kafka to a patched release on the relevant branch as identified in the Spring security advisory.
Restrict producer ACLs so only trusted services can write to topics consumed by Spring Kafka listeners using retry topic configuration.
Audit existing Kafka topics for records carrying retry_topic-attempts headers from unexpected producers.

Patch Information

VMware/Spring has issued fixes for the affected branches. Refer to the Spring Security Advisory CVE-2026-41727 for the specific patched versions corresponding to each supported branch (4.0.x, 3.3.x, 3.2.x, 2.9.x, and 2.8.x).

Workarounds

Implement a RecordInterceptor or consumer-side filter that strips or validates the retry_topic-attempts header on inbound records before the retry topic router processes them.
Apply strict Kafka ACLs to ensure only the Spring Kafka framework's internal retry producers can publish to retry topics.
Segregate retry topics from externally writable topics so that producers cannot inject crafted headers into the retry pipeline.

bash

# Example: restrict producer write access to retry topics using Kafka ACLs
kafka-acls.sh --bootstrap-server broker:9092 \
  --add --deny-principal User:* \
  --operation Write \
  --topic my-app-retry-0 \
  --topic my-app-retry-1 \
  --topic my-app-dlt

kafka-acls.sh --bootstrap-server broker:9092 \
  --add --allow-principal User:spring-kafka-service \
  --operation Write \
  --topic my-app-retry-0 \
  --topic my-app-retry-1 \
  --topic my-app-dlt