CVE-2026-41115

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Published

Jun 1, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.29% · Oct 25, 2026

A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMER_GROUP_DESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists (ACLs), potentially allowing unauthorized users with DESCRIBE permission to access sensitive group metadata. This could result in unintended information disclosure or unauthorized access to group-related information. org.apache.kafka: Apache Kafka: Information disclosure due to improper authorization in CONSUMER_GROUP_DESCRIBE API Moderate: An improper authorization flaw in Apache Kafka's CONSUMER_GROUP_DESCRIBE API could lead to information disclosure. This vulnerability allows users with only DESCRIBE permission on a GROUP resource to access sensitive group metadata, which should typically require READ permission. Exploitation relies on misconfigured Access Control Lists (ACLs) within the Kafka environment. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.