External risk intelligence

STRIMZI Kafka Connect API Access Control Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-36543

The vulnerability exists in the Kafka Connect REST API. While REST APIs can be exposed to the internet, they are frequently deployed within internal networks, management segments, or behind firewalls/proxies to serve backend data processing tasks, making public internet exposure a possibility rather than a standard default deployment pattern.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the Kafka Connect REST API could allow unauthorized access, potentially leading to service denial, data mirroring to an attacker's cluster, and theft of sensitive credentials. The main concern is confirming relevance and exposure.

Uncontrolled access in Kafka Connect REST API.
Protects Kafka data and credentials.
Assess relevance and exposure now.

Attack Path

How an attacker could exploit the issue

An attacker could target the Kafka Connect REST API, which is exposed through the STRIMZI Project. By interacting with the MirrorMaker API, an unauthenticated attacker can cause service disruptions, potentially exfiltrate topic data, and steal Kafka credentials.

No authentication required.
Querying the MirrorMaker REST API.
Potential data theft and denial of service.

Live Threat

Current exploitation, exposure, and threat context

The Kafka Connect REST API, when exposed, could allow an unauthenticated attacker to disrupt Kafka Mirroring services, mirror topic content to a separate cluster, and potentially steal Kafka credentials. This could occur when the MirrorMaker Kafka REST API is accessible over the network and not properly secured.

Kafka Mirroring service and topic data.
Via network access to the REST API.
Service disruption and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Kafka infrastructure and the Strimzi platform should prioritize understanding the reachability and business criticality of affected Kafka Connect REST APIs. The first practical move involves identifying all instances of the vulnerable technology, confirming their exposure, locating the accountable owner, and then planning remediation based on assessed risk.

Kafka and Strimzi platform owners.
Verify API reachability and business impact.
Plan targeted remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Strimzi project and its Kafka Connect component?

Strimzi provides a way to run Apache Kafka on Kubernetes clusters. The Kafka Connect component is a tool within this ecosystem designed to stream data between Kafka and other external systems. It uses a REST API to manage these data-moving connectors, making it a central control point for how information flows in and out of your Kafka environment.

What does CWE-400 mean in the context of CVE-2024-36543?

This vulnerability is classified as CWE-400, or Uncontrolled Resource Consumption. In this case, the lack of proper access controls in the Kafka Connect REST API allows an unauthenticated user to interact with the MirrorMaker API. By abusing this, an attacker can consume or manipulate resources in ways that were never intended, leading to service outages, unauthorized data mirroring, or the theft of sensitive authentication credentials.

How is this vulnerability triggered by an attacker?

An attacker triggers this bug by sending specific, unauthenticated requests directly to the MirrorMaker Kafka REST API. It is important to note that this flaw specifically relates to the REST API endpoints; simply using Kafka for standard messaging or internal cluster communication without exposing the management API does not necessarily trigger this specific access control bypass.

Is my Strimzi deployment at risk of being targeted?

According to Halo Surface Signal, risk depends on how your Kafka Connect REST API is deployed. While these APIs are often kept inside private management networks or behind firewalls, any instance accessible over the internet significantly increases your risk profile. You should verify whether your specific REST API endpoints are reachable from outside your protected environment.

How should I respond to the CVE-2024-36543 advisory?

Begin by inventorying all Strimzi instances running in your environment to identify where Kafka Connect REST APIs are active. Once identified, confirm which of these APIs are network-accessible and evaluate the sensitivity of the data they handle. Coordinate with your infrastructure and platform owners to restrict unauthorized access to these interfaces while preparing to apply official security updates as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.