취약점 이력이 말해 주는 것
Kafka는 역사상 최대 CVSS 점수 9.1을 기록한 17개의 CVE가 등록되어 있으며, Known Exploited Vulnerabilities 카탈로그에는 0개의 항목이 있습니다. 데이터베이스의 가장 최근 CVE 날짜는 2026-06-02입니다.
안전하게 운영하려면
운영자는 지원되는 릴리스 라인에서 배포를 유지하고 설치된 소프트웨어 버전을 적극적으로 추적하여 중요한 보안 업데이트를 적용해야 합니다.
설치된 버전 확인
kafka-topics.sh --version영향받는 버전 라인
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-41115 | Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API | ≥ 4.0.0 ≤ 4.3.0 | 4.3 | — | 2026-06-02 | |
| CVE-2026-33557 | Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication | ≥ 4.1.0 < 4.1.2 | 9.1 | — | 2026-04-20 | |
| CVE-2026-33558 | Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output | ≥ 0.11.0.0 < 3.9.2 = 4.0.0 | 5.3 | — | 2026-04-20 | |
| CVE-2026-35554 | Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition | ≥ 2.8.0 < 3.9.2 ≥ 4.0.0 < 4.0.2 ≥ 4.1.0 < 4.1.2 | 8.7 | — | 2026-04-07 | |
| CVE-2025-27817 | Apache Kafka Client: Arbitrary file read and SSRF vulnerability | ≥ 3.1.0 < 3.9.1 | 7.5 | — | 2025-06-10 | |
| CVE-2025-27819 | Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration | ≥ 2.0.0 ≤ 3.3.2 | 7.5 | — | 2025-06-10 | |
| CVE-2025-27818 | Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration | ≥ 2.3.0 < 3.9.1 | 8.8 | — | 2025-06-10 | |
| CVE-2024-56128 | Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption | ≥ 0.10.2.0 < 3.7.2 = 3.8.0 | 5.3 | — | 2024-12-18 | |
| CVE-2024-31141 | Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider | ≥ 2.3.0 ≤ 3.5.2 ≥ 3.6.0 ≤ 3.6.2 = 3.7.0 | 6.5 | — | 2024-11-19 | |
| CVE-2024-27309 | Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode | ≥ 3.5.0 ≤ 3.6.1 | 7.4 | — | 2024-04-12 | |
| CVE-2022-34917 | Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers | ≥ 2.8.0 < 2.8.2 ≥ 3.0.0 < 3.0.2 ≥ 3.1.0 < 3.1.2 | 7.5 | — | 2022-09-20 | |
| CVE-2021-38153 | Timing Attack Vulnerability for Apache Kafka Connect and Clients | ≥ 2.0.0 < 2.6.3 ≥ 2.7.0 < 2.7.2 = 2.8.0 | 5.9 | — | 2021-09-22 | |
| CVE-2020-27218 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11... | = 2.7.0 | 4.8 | — | 2020-11-28 | |
| CVE-2019-12399 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with on... | = 2.0.0 = 2.0.1 = 2.1.0 | 7.5 | — | 2020-01-14 | |
| CVE-2018-17196 | In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which... | ≥ 0.11.0.0 ≤ 2.1.0 | 8.8 | — | 2019-07-12 | |
| CVE-2017-12610 | In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonati... | ≥ 0.10.0.0 ≤ 0.10.2.1 ≥ 0.11.0.0 ≤ 0.11.0.1 | 6.8 | — | 2018-07-26 | |
| CVE-2018-1288 | In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka... | > 0.9.0.0 ≤ 0.9.0.1 ≥ 0.10.0.0 ≤ 0.10.2.1 ≥ 0.11.0.0 ≤ 0.11.0.2 | 5.4 | — | 2018-07-26 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).