- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 15
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
15 assets you may test, 6 excluded.
Web 1
- https://kafka.apache.org
Products and areas 14
- Delegation tokens: issuance, renewal, expiry and the HMAC that authenticates them
- JMX, the metrics surface and any endpoint that exposes cluster or client state
- Kafka Connect end to end: the REST API, connector and converter configuration, plugin path loading and the worker's execution of connector code
- Kafka Streams and the state stores it maintains on local disk
- Log segment, index and snapshot parsing on startup and recovery
- Produce-path decompression across gzip, snappy, lz4 and zstd, and the record batch format the broker validates
- Replication and the follower fetch protocol, including how a broker decides another broker is entitled to replicate a partition
- The admin client operations and the shipped command line tools in bin/, plus MirrorMaker 2
- The ASF security process accepts any undisclosed vulnerability in an Apache project privately, and Kafka declares no scope narrower than the code the project releases. Everything below sits inside that
- The authentication layer across SASL PLAIN, SCRAM, GSSAPI and OAUTHBEARER, mutual TLS, and the principal builder that turns a certificate or a token into a Kafka identity
- The authorizer and ACL evaluation, covering topic, group, cluster, transactional ID and delegation token resources, prefix matching and deny precedence
- The broker's handling of the wire protocol in full, every request type and every version of each, including the versions a client can negotiate down to
- The group coordinator and the consumer group protocol, along with the transaction coordinator and the exactly-once machinery
- The KRaft controller quorum, the metadata log and the records that flow through it, plus the ZooKeeper-mode metadata paths the project still ships
Out of scope (6)
- A broker deliberately configured with a PLAINTEXT listener and no authorizer, which is a deployment decision
- Confluent Platform, Amazon MSK, Aiven and other managed or repackaged distributions, all of which run their own programmes over their own infrastructure
- Connectors, converters and client libraries maintained outside the apache/kafka repository
- Reports filed publicly on JIRA or GitHub rather than through the ASF security list
- The JVM, the operating system and the filesystem underneath the broker
- ZooKeeper itself, a separate Apache project with its own process
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report privately to the address on the policy page , the project's ASF security list. the address on the policy page reaches the foundation team and works as a fallback
-
Do not open a public JIRA issue or a GitHub issue for a security bug. The ASF process is private until the announcement
-
Do not file this at the managed-service programmes. Aiven, Amazon MSK and Confluent scope their own infrastructure, and a finding in upstream apache/kafka is out of scope for all of them
-
Say whether the cluster ran in KRaft mode or with ZooKeeper. The metadata and controller surface differs completely between the two
-
Name the security protocol and mechanism precisely: the listener, whether SASL was in use and which mechanism, and how the principal was derived. Nearly everything severe here turns on that derivation
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 35 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-97355 | Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-97356 | External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-82960 | Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because th | High 8.8 | 5 Nov 2026 |
| CVE-2026-83538 | Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no p | Medium 5.3 | 5 Nov 2026 |
| CVE-2026-83542 | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-84183 | Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CR | High 8.8 | 5 Nov 2026 |
| CVE-2026-84728 | Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostn | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-85627 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no | High 8.8 | 5 Nov 2026 |
| CVE-2026-92887 | Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of th | High 7.3 | 5 Nov 2026 |
| CVE-2026-82904 | Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by mu | High 7.5 | 5 Nov 2026 |
| CVE-2026-82907 | Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-82910 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute | High 8.8 | 5 Nov 2026 |
| CVE-2026-82912 | Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the | High 8.8 | 5 Nov 2026 |
| CVE-2026-82916 | Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassw | High 7.1 | 5 Nov 2026 |
| CVE-2026-82902 | Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supply | Medium 4.3 | 5 Nov 2026 |
| CVE-2026-114233 | Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShi | High 8.1 | 5 Nov 2026 |
| CVE-2026-114235 | Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114271 | Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other part | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114272 | Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommend | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114277 | Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109129 | Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via the updateOrderPaymentPreference service, by supplying an orderPaymentPreferenceId belonging to a differ | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109837 | Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109856 | Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, creat | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109928 | Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative | High 7.4 | 5 Nov 2026 |
| CVE-2026-114229 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade | Medium 6.1 | 5 Nov 2026 |
| CVE-2026-59267 | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.8 | 4 Nov 2026 |
| CVE-2026-90631 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes | Low 3.3 | 4 Nov 2026 |
| CVE-2026-90632 | Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90634 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90624 | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90626 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90627 | The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90628 | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90629 | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59264 | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.8 | 4 Nov 2026 |
| CVE-2026-59268 | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59263 | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Low 1.9 | 4 Nov 2026 |
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to vers | Critical 9.8 | 30 Oct 2026 |
| CVE-2026-65874 | This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existin | High 8.8 | 30 Oct 2026 |
| CVE-2026-95628 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose f | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95629 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling tool in CLI mode, the default, and tells it where to write the converted document through the --output flag. When the CamelDoclingOutputFilePat | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95663 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection | Medium 4.8 | 26 Oct 2026 |
| CVE-2026-95664 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-101259 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Intern | Medium 5.3 | 26 Oct 2026 |
| CVE-2026-111497 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie | Critical 9.2 | 22 Oct 2026 |
| CVE-2026-88900 | Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an Objec | High 8.8 | 19 Oct 2026 |
| CVE-2026-85313 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that let | Medium 4.3 | 19 Oct 2026 |
| CVE-2026-85314 | Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange w | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85315 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the status cause, which stays local to the server, the description is transmitted to th | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85316 | Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rather than by matching the path exactly. Any endpoint whose path merely begins with t | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85317 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token w | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85254 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by va | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85257 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client in the fault: CXF copies the message into the SOAP f | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85260 | Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the | Medium 5.5 | 19 Oct 2026 |
| CVE-2026-85296 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85312 | Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85247 | Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on | Medium 5.9 | 19 Oct 2026 |
| CVE-2026-85249 | Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is attacker-controlled content: the party that supplies the file chooses the metadata ke | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85250 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default documen | High 7.5 | 19 Oct 2026 |
| CVE-2026-85251 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequ | High 7.5 | 19 Oct 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview Kafka is the event-streaming backbone in most enterprise data platforms, the durable log that payment events, audit trails and change-data-capture streams pass through. Confluent, Amazon MSK and Aiven all run the same upstream code. A defect in its authentication or its ACL evaluation is a read of every topic on the cluster, and what sits in those topics is usually the organisation's most sensitive in-flight record. The Apache Software Foundation runs no bug bounty for any project, the EU-funded programme that once paid for Kafka closed in 2020, and the platform listings cover managed vendors rather than this code. sorona.xyz pays you directly on qualified, reproduced findings. In scope The ASF security process accepts any undisclosed vulnerability in an Apache project privately, and Kafka declares no scope narrower than the code the project releases. Everything below sits inside that The broker's handling of the wire protocol in full, every request type and every version of each, including the versions a client can negotiate down to The authentication layer across SASL PLAIN, SCRAM, GSSAPI and OAUTHBEARER, mutual TLS, and the principal builder that turns a certificate or a token into a Kafka identity The authorizer and ACL evaluation, covering topic, group, cluster, transactional ID and delegation token resources, prefix matching and deny precedence The KRaft controller quorum, the metadata log and the records that flow through it, plus the ZooKeeper-mode metadata paths the project still ships Replication and the follower fetch protocol, including how a broker decides another broker is entitled to replicate a partition The group coordinator and the consumer group protocol, along with the transaction coordinator and the exactly-once machinery Kafka Connect end to end: the REST API, connector and converter configuration, plugin path loading and the worker's execution of connector code Kafka Streams and the state stores it maintains on local disk Delegation tokens: issuance, renewal, expiry and the HMAC that authenticates them Produce-path decompression across gzip, snappy, lz4 and zstd, and the record batch format the broker validates Log segment, index and snapshot parsing on startup and recovery The admin client operations and the shipped command line tools in bin/ , plus MirrorMaker 2 JMX, the metrics surface and any endpoint that exposes cluster or client state Out of scope Confluent Platform, Amazon MSK, Aiven and other managed or repackaged distributions, all of which run their own programmes over their own infrastructure Connectors, converters and client libraries maintained outside the apache/kafka repository ZooKeeper itself, a separate Apache project with its own process A broker deliberately configured with a PLAINTEXT listener and no authorizer, which is a deployment decision The JVM, the operating system and the filesystem underneath the broker Reports filed publicly on JIRA or GitHub rather than through the ASF security list Most-valued findings ACL evaluation defects where a principal reads from or writes to a topic, group or transactional ID its grants never covered, including prefix matching and the interaction between allow and deny rules Authentication bypass in any SASL mechanism, and principal builder defects where a certificate or an OAuth token yields an identity it should not, since the principal is the input to every authorization decision Kafka Connect's REST API, where connector configuration becomes code execution on the worker. A Connect worker holds credentials for every system it syncs with Deserialization reachable from the wire protocol or from converter configuration, the recurring high-severity class in JVM data infrastructure KRaft controller paths that accept metadata records from a node the quorum should not admit, or that let a broker alter cluster metadata it does not own Inter-broker replication trusting a peer's claimed identity, which turns one compromised broker into a read of every partition Produce-path decompression and record batch validation that a client can drive into unbounded allocation or a crash, since any producer can reach it Log segment and index parsing on recovery, where a file written by a peer or a restore is parsed by a broker at startup Delegation token issuance and renewal, where a token outlives or outreaches the identity that requested it CVE-2026-35554 and CVE-2026-41115 are the two entries the study records for the current cycle. It describes neither, so treat the published record as thin rather than as evidence the surface is clean Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , the project's ASF security list. [email protected] reaches the foundation team and works as a fallback Do not open a public JIRA issue or a GitHub issue for a security bug. The ASF process is private until the announcement The ASF states that it does not have a bug bounty program and does not endorse or offer one for any of its projects. There is no reward at any severity Do not file this at the managed-service programmes. Aiven, Amazon MSK and Confluent scope their own infrastructure, and a finding in upstream apache/kafka is out of scope for all of them Say whether the cluster ran in KRaft mode or with ZooKeeper. The metadata and controller surface differs completely between the two Name the security protocol and mechanism precisely: the listener, whether SASL was in use and which mechanism, and how the principal was derived. Nearly everything severe here turns on that derivation Disclosure Coordinated by the Kafka project management committee together with the ASF security team, which takes the report privately, works the fix and publishes a CVE with the fixed releases. Kafka backports across supported minor versions, so the embargo runs to that coordinated release. Advisories appear on the project's CVE list page. Hold detail until the announcement goes out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability