You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@kafka.apache.org by "showuon (via GitHub)" <gi...@apache.org> on 2026/06/02 08:04:35 UTC
[PR] MINOR: Fix and add CVE-2026-41115 info [kafka-site]
showuon opened a new pull request, #875:
URL: https://github.com/apache/kafka-site/pull/875
Fix and add CVE-2026-41115 info
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Fix and add CVE-2026-41115 info [kafka-site]
Posted by "showuon (via GitHub)" <gi...@apache.org>.
showuon commented on PR #875:
URL: https://github.com/apache/kafka-site/pull/875#issuecomment-4600175800
PR updated. Thanks for review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Fix and add CVE-2026-41115 info [kafka-site]
Posted by "showuon (via GitHub)" <gi...@apache.org>.
showuon merged PR #875:
URL: https://github.com/apache/kafka-site/pull/875
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Fix and add CVE-2026-41115 info [kafka-site]
Posted by "showuon (via GitHub)" <gi...@apache.org>.
showuon commented on code in PR #875:
URL: https://github.com/apache/kafka-site/pull/875#discussion_r3339708980
##########
content/en/community/cve-list.md:
##########
@@ -28,7 +28,66 @@ type: docs
This page lists all security vulnerabilities fixed in released versions of Apache Kafka.
-This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions.
+This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions.
+
+## [CVE-2026-41115](https://nvd.nist.gov/vuln/detail/CVE-2026-41115) Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API {#CVE-2026-41115}
+
+The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848.
+This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures,
+like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
+
+The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct.
+However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission.
Review Comment:
Ah, right, `have been updated`. Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Fix and add CVE-2026-41115 info [kafka-site]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on code in PR #875:
URL: https://github.com/apache/kafka-site/pull/875#discussion_r3339638183
##########
content/en/community/cve-list.md:
##########
@@ -28,7 +28,66 @@ type: docs
This page lists all security vulnerabilities fixed in released versions of Apache Kafka.
-This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions.
+This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions.
+
+## [CVE-2026-41115](https://nvd.nist.gov/vuln/detail/CVE-2026-41115) Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API {#CVE-2026-41115}
+
+The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848.
Review Comment:
`that documented` -> `as documented`
`kafka` -> `Kafka`
`the KIP-848` -> `KIP-848`
##########
content/en/community/cve-list.md:
##########
@@ -28,7 +28,66 @@ type: docs
This page lists all security vulnerabilities fixed in released versions of Apache Kafka.
-This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions.
+This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions.
+
+## [CVE-2026-41115](https://nvd.nist.gov/vuln/detail/CVE-2026-41115) Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API {#CVE-2026-41115}
+
+The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848.
+This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures,
+like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
+
+The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct.
+However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission.
Review Comment:
`kafka` -> `Kafka`
`the KIP-848` -> `KIP-848`
`will be updated` -> `have been updated`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org