CVE-2026-41115

The implementation of the CONSUMERGROUPDESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.

The correct permission for CONSUMERGROUPDESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.3.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41115.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-285"
    ]
}

References

Affected packages

Git / github.com/apache/kafka

Affected ranges

Type

GIT

Repo

https://github.com/apache/kafka

Events

Introduced

985bc99521dd22bbf620591b8db8613c54f596b2

Last affected

a9ce3221537b8653448750697915607dc7936cf3

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.3.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41115.json"