New Kafka Connect Vulnerability (CVE-2025-27817) Lets Attackers Read Any File

About Author
Hi, I'm Sharon, a product manager at Chaitin Tech. We build SafeLine, an open-source Web Application Firewall built for real-world threats. While SafeLine focuses on HTTP-layer protection, our emergency response center monitors and responds to RCE and authentication vulnerabilities across the stack to help developers stay safe.

On June 10, 2025, the Apache team released a security advisory for a critical vulnerability in Kafka Connect: CVE-2025-27817. This flaw allows unauthenticated attackers to remotely read arbitrary files from the server—no user interaction required.

If you’re using Apache Kafka Connect or systems that integrate it (like Apache Druid), you need to patch ASAP.

What’s the issue?

Kafka Connect’s vulnerability comes from insecure handling of two configuration parameters:

• sasl.oauthbearer.token.endpoint.url
• sasl.oauthbearer.jwks.endpoint.url

These were not properly sanitized. By crafting malicious URLs, attackers can trigger arbitrary file reads or even perform SSRF (Server-Side Request Forgery).

Potential Impact

• Arbitrary File Read: Attackers can access sensitive files on the server, including credentials and config files.
• No authentication required
• Works under default configuration
• High risk, easy to exploit
• Impacts remote systems over the network

Affected Versions

Apache Kafka: 3.1.0 – 3.9.0

How to fix it

Temporary Workarounds

• Don’t expose Kafka Connect directly to the internet.
• In standalone mode, check and restrict the following:
  • connect-standalone.properties: listeners, rest.host.name
• In distributed mode:
  • connect-distributed.properties: listeners, rest.host.name
• Use a Web Application Firewall (like SafeLine) or firewall rules to block suspicious requests to /connectors with file paths.

Official Patch

Apache has released version 3.9.1, which addresses this issue. Upgrade now:

Download Kafka 3.9.1

Reproduction

Detection & Protection

Timeline

• June 10, 2025: CVE disclosure and advisory published by Apache and Changting Security Team.

References

• Apache Mailing List Disclosure

Join the SafeLine Community

• GitHub Repository
• Official Docs
• Discord Community