Description
Kafka Connect 存在任意文件读取漏洞，由于在 SASL/OAUTHBEARER 和 SASL JAAS 配置中未对 URL和登录模块进行严格限制，从而造成的客户端的敏感数据和内网信息泄露。
Kafka Connect 存在任意文件读取漏洞（CVE-2025-27817）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-27817
https://kafka.apache.org/community/cve-list/
https://github.com/advisories/GHSA-vgq5-3255-v292
https://zhuanlan.zhihu.com/p/1942317485052375348
https://blog.csdn.net/WangsuSecurity/article/details/150617157
https://www.ihonker.com/thread-33310-1-1.html
https://avd.aliyun.com/product?prod=Kafka
https://nsfocusglobal.com/apache-kafka-arbitrary-file-read-and-ssrf-vulnerability-cve-2025-27817/
https://support.confluent.io/hc/en-us/articles/39740309244180-CONFSA-2025-04-CVE-2025-27817-Confluent-Platform-and-Confluent-Cloud-Arbitrary-File-Read-and-Server-Side-Request-Forgery-SSRF-Vulnerability-via-unauthorized-changes-to-Kafka-Client-SASL-OAUTHBEARER-configuration