CVE-2024-27309

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-27309", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-02-22T18:32:26.014Z", "datePublished": "2024-04-12T06:58:45.134Z", "dateUpdated": "2025-07-30T03:55:45.408Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Kafka", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.5.2", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThanOrEqual": "3.6.1", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><div><div><div><div><div><div><div><div><div><div>While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.</div><div><br>Two preconditions are needed to trigger the bug:<br>1. The administrator decides to remove an ACL<br>2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.<br><br>When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.</div><br><div>The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).</div><br><div>The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.</div></div></div></div></div></div></div></div></div></div></div></div><div><div><div><div><div><div></div></div></div></div></div></div>"}], "value": "While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.\n\nTwo preconditions are needed to trigger the bug:\n1. The administrator decides to remove an ACL\n2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.\n\nWhen those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.\n\nThe incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).\n\nThe full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period."}], "metrics": [{"other": {"content": {"text": "critical"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-07-05T16:06:03.962Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/12/3"}, {"url": "https://security.netapp.com/advisory/ntap-20240705-0002/"}], "source": {"discovery": "INTERNAL"}, "title": "Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "apache", "product": "kafka", "cpes": ["cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "3.5.0", "status": "affected", "lessThanOrEqual": "3.5.2", "versionType": "custom"}, {"version": "3.6.0", "status": "affected", "lessThanOrEqual": "3.6.1", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-29T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-27309"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-30T03:55:45.408Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:28:00.345Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/12/3", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240705-0002/", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/12/3", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240705-0002/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:28:00.345Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27309", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-08T18:38:58.405732Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "kafka", "versions": [{"status": "affected", "version": "3.5.0", "versionType": "custom", "lessThanOrEqual": "3.5.2"}, {"status": "affected", "version": "3.6.0", "versionType": "custom", "lessThanOrEqual": "3.6.1"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-08T18:39:39.264Z"}}], "cna": {"title": "Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode", "source": {"discovery": "INTERNAL"}, "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "versions": [{"status": "affected", "version": "3.5.0", "versionType": "semver", "lessThanOrEqual": "3.5.2"}, {"status": "affected", "version": "3.6.0", "versionType": "semver", "lessThanOrEqual": "3.6.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/12/3"}, {"url": "https://security.netapp.com/advisory/ntap-20240705-0002/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.\n\nTwo preconditions are needed to trigger the bug:\n1. The administrator decides to remove an ACL\n2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.\n\nWhen those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.\n\nThe incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).\n\nThe full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><div><div><div><div><div><div><div><div><div>While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.</div><div><br>Two preconditions are needed to trigger the bug:<br>1. The administrator decides to remove an ACL<br>2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.<br><br>When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.</div><br><div>The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).</div><br><div>The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.</div></div></div></div></div></div></div></div></div></div></div></div><div><div><div><div><div><div></div></div></div></div></div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-07-05T16:06:03.962Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27309", "state": "PUBLISHED", "dateUpdated": "2025-07-30T03:55:45.408Z", "dateReserved": "2024-02-22T18:32:26.014Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-04-12T06:58:45.134Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Kafka", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.5.2", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThanOrEqual": "3.6.1", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "source": "security@apache.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "kafka", "vendor": "apache", "versions": [{"lessThanOrEqual": "3.5.2", "status": "affected", "version": "3.5.0", "versionType": "custom"}, {"lessThanOrEqual": "3.6.1", "status": "affected", "version": "3.6.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA81784F-A227-4DFE-8711-840EB6031279", "versionEndIncluding": "3.6.1", "versionStartIncluding": "3.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.\n\nTwo preconditions are needed to trigger the bug:\n1. The administrator decides to remove an ACL\n2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.\n\nWhen those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.\n\nThe incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).\n\nThe full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period."}, {"lang": "es", "value": "Mientras se migra un cl\u00faster de Apache Kafka del modo ZooKeeper al modo KRaft, en algunos casos las ACL no se aplicar\u00e1n correctamente. Se necesitan dos condiciones previas para desencadenar el error: 1. El administrador decide eliminar una ACL. 2. El recurso asociado con la ACL eliminada contin\u00faa teniendo dos o m\u00e1s ACL asociadas despu\u00e9s de la eliminaci\u00f3n. Cuando se cumplen esas dos condiciones previas, Kafka tratar\u00e1 el recurso como si tuviera solo una ACL asociada despu\u00e9s de la eliminaci\u00f3n, en lugar de las dos o m\u00e1s que ser\u00edan correctas. La condici\u00f3n incorrecta se elimina eliminando todos los intermediarios en modo ZK o agregando una nueva ACL al recurso afectado. Una vez que se completa la migraci\u00f3n, no hay p\u00e9rdida de metadatos (todas las ACL permanecen). El impacto total depende de las ACL en uso. Si solo se configuraran ALLOW ACL durante la migraci\u00f3n, el impacto se limitar\u00eda al impacto en la disponibilidad. Si se configuraron DENY ACL, el impacto podr\u00eda incluir un impacto en la confidencialidad e integridad seg\u00fan las ACL configuradas, ya que DENY ACL podr\u00edan ignorarse debido a esta vulnerabilidad durante el per\u00edodo de migraci\u00f3n."}], "id": "CVE-2024-27309", "lastModified": "2026-06-17T07:19:37.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27309", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-29T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2024-04-12T07:15:08.560", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2024/04/12/3"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20240705-0002/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2024/04/12/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20240705-0002/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode", "id": "2291362", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2291362"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.\nTwo preconditions are needed to trigger the bug:\n1. The administrator decides to remove an ACL\n2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.\nWhen those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.\nThe incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).\nThe full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.", "A flaw was found in Apache Kafka during the migration from ZooKeeper (ZK) to KRaft mode that affects Access Control List (ACL) enforcement. Specifically, when an ACL is removed from a resource and the resource retains two or more other ACLs, Kafka may incorrectly treat the resource as having only one ACL. This issue can lead to misconfigured access permissions during the migration period. Depending on the type of ACLs (ALLOW or DENY) in use, the impact ranges from potential availability issues (for ALLOW ACLs) to confidentiality and integrity risks (for DENY ACLs). The bug can be mitigated by resetting broker states or adding new ACLs without causing metadata loss."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-27309", "package_state": [{"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Will not fix", "package_name": "kafka", "product_name": "streams for Apache Kafka"}], "public_date": "2024-04-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27309\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27309"], "statement": "The vulnerability in Apache Kafka during the migration from ZooKeeper (ZK) to KRaft mode is of Moderate severity due to its potential impact on access control enforcement. By incorrectly interpreting the number of ACLs associated with a resource after an ACL removal, Kafka may misapply access permissions during the transitional phase. This could lead to temporary lapses in security enforcement, particularly concerning confidentiality and integrity for DENY ACLs or availability for ALLOW ACLs. While the bug does not result in permanent data loss or corruption, it necessitates careful management to prevent unauthorized access or disruption during the migration process. Immediate mitigation involves resetting broker states or strategically adding new ACLs to affected resources to restore correct access control functionality.\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-863: Incorrect Authorization vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nThe platform's native Role-Based Access Control (RBAC), namespace-level isolation, and network segmentation collectively constrain the scope of access. Access to the platform is granted only after successful hard token, multi-factor authentication (MFA), which is coupled with least privilege principles to ensure that only authorized roles and users can execute or manipulate code. Event logs are collected and processed for centralization, correlation, analysis, monitoring, reporting, alerting, and retention, which helps detect and alert of any atypical use cases or anomalous behavior. Additionally, the platform requires the use of non-privileged accounts when accessing systems that don\u2019t require elevated access.", "threat_severity": "Moderate"}

{}