What is CVE-2024-27309?

CVE-2024-27309 is a high-severity vulnerability in Apache Kafka, classified under Incorrect Authorization. CVSS score: 7.4/10. Published 2024-04-12.

How severe is CVE-2024-27309?

High severity. CVSS v3 base score is 7.4 out of 10.

Auth bypass in Apache Kafka

CVE-2024-27309

While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The re…

Vulnerability class: Broken Access Control

EPSS: 0.011 (62.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Apache Kafka
Apache Software Foundation Kafka — versions 3.5.0, 3.6.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
security@apache.org (Mailing List, Third Party Advisory)
security@apache.org (Third Party Advisory)

Frequently asked questions

What is CVE-2024-27309?: CVE-2024-27309 is a high-severity vulnerability in Apache Kafka, classified under Incorrect Authorization. CVSS score: 7.4/10. Published 2024-04-12.
How severe is CVE-2024-27309?: High severity. CVSS v3 base score is 7.4 out of 10.