{"apiVersion":"1.0","identifier":"CVE-2026-41115","description":"An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.","publishedAt":"2026-06-02T10:16:25","lastModifiedAt":"2026-07-22T19:10:00","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41115","cvssScore":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","epssProbability":0.00288,"riskScore":0.44,"affectedProduct":"Apache Kafka","affectedVersions":"unknown","vulnerabilityType":"Core software","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-41115","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-41115","en":"https://www.redsauce.net/en/cves/CVE-2026-41115","fr":"https://www.redsauce.net/fr/cves/CVE-2026-41115","pt":"https://www.redsauce.net/pt/cves/CVE-2026-41115","de":"https://www.redsauce.net/de/cves/CVE-2026-41115","sk":"https://www.redsauce.net/sk/cves/CVE-2026-41115","el":"https://www.redsauce.net/el/cves/CVE-2026-41115"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-41115"}}