You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by "Lucas Brutschy (Jira)" <ji...@apache.org> on 2025/02/18 09:46:00 UTC

[jira] [Updated] (KAFKA-18819) StreamsGroupHeartbeat API and StreamsGroupDescribe API must check topic describe

     [ https://issues.apache.org/jira/browse/KAFKA-18819?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lucas Brutschy updated KAFKA-18819:
-----------------------------------
    Description: ConsumerGroupHeartbeat API and ConsumerGroupDescribe API must check topic describe to ensure that we don't leak topic information to clients without the required permissions. The simplest approach seems to filter out unauthorised topics from the responses of those APIs.

> StreamsGroupHeartbeat API and StreamsGroupDescribe API must check topic describe
> --------------------------------------------------------------------------------
>
>                 Key: KAFKA-18819
>                 URL: https://issues.apache.org/jira/browse/KAFKA-18819
>             Project: Kafka
>          Issue Type: Sub-task
>            Reporter: Lucas Brutschy
>            Priority: Major
>
> ConsumerGroupHeartbeat API and ConsumerGroupDescribe API must check topic describe to ensure that we don't leak topic information to clients without the required permissions. The simplest approach seems to filter out unauthorised topics from the responses of those APIs.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)