mimaison commented on code in PR #875: URL: https://github.com/apache/kafka-site/pull/875#discussion_r3339638183
########## content/en/community/cve-list.md: ########## @@ -28,7 +28,66 @@ type: docs This page lists all security vulnerabilities fixed in released versions of Apache Kafka. -This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions. +This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions. + +## [CVE-2026-41115](https://nvd.nist.gov/vuln/detail/CVE-2026-41115) Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API {#CVE-2026-41115} + +The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. Review Comment: `that documented` -> `as documented` `kafka` -> `Kafka` `the KIP-848` -> `KIP-848` ########## content/en/community/cve-list.md: ########## @@ -28,7 +28,66 @@ type: docs This page lists all security vulnerabilities fixed in released versions of Apache Kafka. -This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions. +This page does **not** list security advisories for dependencies of Kafka. If your security scanner warns that there is an advisory for a dependency of Kafka, please see [this documentation](https://security.apache.org/report-dependency/). You can find the current development versions of various dependencies [here](https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle). You can find a list of advisories that have been confirmed not to apply to Kafka [here](https://github.com/apache/kafka/blob/trunk/gradle/resources/dependencycheck-suppressions.xml). You are invited to [contribute](https://kafka.apache.org/contributing.html) version updates or (motivated) suppressions. + +## [CVE-2026-41115](https://nvd.nist.gov/vuln/detail/CVE-2026-41115) Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API {#CVE-2026-41115} + +The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. +This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, +like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. + +The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. +However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. Review Comment: `kafka` -> `Kafka` `the KIP-848` -> `KIP-848` `will be updated` -> `have been updated` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
