Server-Side Request Forgery (SSRF) in Apache Kafka - CVE-2025-27817

Vulnerability identifier: #VU112146

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-27817

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Apache Kafka Client. The application accepts configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Apache Kafka
IBM Observability with Instana
Netcool Operations Insight
IBM Fusion HCI
IBM Spectrum Control
IBM Maximo Asset Management
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
Oracle Enterprise Data Quality
IBM Business Automation Workflow
IBM Maximo Application Suite - Manage Component
App Connect Enterprise Certified Container
envoy
watsonx.data
Guardium Data Security Center (GDSC)
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Oracle Financial Services Analytical Applications Infrastructure
Maximo Application Suite - Monitor Component
IBM Business Automation Manager Open Editions
Integration Bus for z/OS
InfoSphere Data Replication
Oracle Communications Network Charging and Control
Business Automation Insights
Telco Service Orchestrator
Communications Unified Assurance
Communications Service Catalog and Design
Oracle Communications Billing and Revenue Management
IBM Qradar SIEM
IBM App Connect Enterprise
Oracle Communications Convergent Charging Controller
Siebel CRM Integration
Siebel CRM Deployment
Oracle SOA Suite
Oracle Banking Credit Facilities Process Management
Oracle Banking Virtual Account Management
Oracle Banking Supply Chain Finance
Oracle Banking Trade Finance Process Management
Oracle Banking Corporate Lending Process Management
Oracle Banking Branch
Oracle Banking Cash Management
Oracle Banking Liquidity Management
Oracle Banking Origination
AMQ Streams
IBM Cloud Pak for Multicloud Management

Install updates from vendor's website.

Apache Kafka - update to 3.9.1
IBM Observability with Instana - update to 1.0.298
Netcool Operations Insight - update to 1.6.15
envoy - addressed in versions 1.33.10, 1.34.8, 1.35.4
IBM Fusion HCI - update to 2.11.0
watsonx.data - update to 2.2.1
Guardium Data Security Center (GDSC) - addressed in versions 3.8.1, 3.8.5
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.1
IBM Spectrum Control - update to 5.4.13.2
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
IBM Maximo Asset Management - update to 7.6.1.3.35
Maximo Application Suite - Monitor Component - addressed in versions 8.10.21, 8.11.19, 9.0.11
IBM Business Automation Manager Open Editions - update to 9.2.1
Integration Bus for z/OS - update to 10.1.0.6
IBM App Connect Enterprise - addressed in versions 12.0.12.16, 13.0.4.1
IBM Business Automation Workflow - addressed in versions 24.0.0-IF007, 24.0.1-IF005, 25.0.0-IF001
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
AMQ Streams - addressed in versions 2, 3.1.0
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
Telco Service Orchestrator - update to 5.3.3
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.28, 8.7.22, 9.0.15, 9.1.1
App Connect Enterprise Certified Container - addressed in versions 12.0.14, 12.14.0

• Exploit #11899 - CVE-2025-27817 (August 29, 2025)
• Exploit #11751 - CVE-2025-27817 (July 3, 2025)

• https://lists.apache.org/thread/6cm2d0q5126lp7w591wt19211s5xxcsm

• SSRF in Apache Kafka Client
• HPE Telco Service Orchestrator update for Apache Kafka
• Multiple vulnerabilities in AMQ Streams
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Enterprise Data Quality
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus for z/OS
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Communications Convergent Charging Controller
• Multiple vulnerabilities in Oracle Communications Network Charging and Control
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Communications Service Catalog and Design
• Server-Side Request Forgery (SSRF) in Oracle SOA Suite
• Multiple vulnerabilities in Oracle Banking Branch
• Envoy update for third-party components
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Red Hat AMQ Streams update for Apache Kafka
• Multiple vulnerabilities in IBM InfoSphere Data Replication
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in Siebel CRM Deployment
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle Banking Trade Finance Process Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Siebel CRM Integration