How severe is CVE-2026-41115?

CVE-2026-41115 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-41115 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-41115?

CVE-2026-41115 affects Apache Kafka. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-41115?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-41115 have an EU (EUVD) identifier?

Yes. CVE-2026-41115 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-33904.

When was CVE-2026-41115 published?

CVE-2026-41115 was published on 2026-06-02 and last updated on 2026-06-17.

CVE-2026-41115

CVE-2026-41115 is a medium-severity vulnerability in Apache Kafka with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-285.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (21st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-33904
Weakness: CWE-285
Affected product: Apache Kafka
Published: 2026-06-02
Last modified: 2026-06-17

Description

An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.

Frequently asked questions

What is CVE-2026-41115?: An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
How severe is CVE-2026-41115?: CVE-2026-41115 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-41115 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-41115?: CVE-2026-41115 affects Apache Kafka. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-41115?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-41115 have an EU (EUVD) identifier?: Yes. CVE-2026-41115 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-33904.
When was CVE-2026-41115 published?: CVE-2026-41115 was published on 2026-06-02 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Kafka

CVE-2026-33557 — Critical (CVSS 9.1): A possible security vulnerability has been identified in Apache Kafka. By default, the broker property…
CVE-2025-27818 — High (CVSS 8.8): A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to…
CVE-2018-17196 — High (CVSS 8.8): In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses…
CVE-2025-27819 — High (CVSS 7.5): In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka…
CVE-2025-27817 — High (CVSS 7.5): A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients…
CVE-2022-34917 — High (CVSS 7.5): A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability…

All CVEs affecting Apache Kafka →

Other CWE-285 (Improper Authorization) vulnerabilities

CVE-2025-65041 — Critical (CVSS 10.0): Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2023-33189 — Critical (CVSS 10.0): Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization…
CVE-2022-2595 — Critical (CVSS 10.0): Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.
CVE-2021-28799 — Critical (CVSS 10.0): An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If…
CVE-2026-34048 — Critical (CVSS 9.9): Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to…
CVE-2026-5412 — Critical (CVSS 9.9): In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated…

Browse all CWE-285 (Improper Authorization) vulnerabilities →