CVE-2026-41731: In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

Synopsis

This is an insecure deserialization vulnerability in Spring for Apache Kafka's header mapper components (JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper). It is reachable over the network without authentication, though exploitation requires overcoming some environmental complexity. A successful attacker who controls Kafka message headers can cause a consumer to deserialize arbitrary JDK types, enabling remote code execution, data disclosure, or data tampering. Patched-image rebuilds at versions 2.8.12, 2.9.14, 3.2.14, 3.3.16, and 4.0.6 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Kafka broker over the network and produce messages to a topic consumed by the vulnerable application.

• AuthenticationNot required

  No authentication credentials are required; any producer that can publish to the relevant Kafka topic can deliver crafted headers.

• Victim interactionNot required

  No victim interaction is needed; the consumer processes incoming Kafka messages automatically without any human action.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must satisfy conditions beyond simple message delivery, such as controlling the topic or bypassing broker-level access controls that may exist in a given deployment.

Blast Radius

• A successful attacker achieves remote code execution in the context of the Kafka consumer process by triggering deserialization of a crafted JDK gadget chain.
• Arbitrary code execution gives the attacker read access to secrets, credentials, and application data held in memory or accessible from the consumer host.
• The attacker can write or modify application state, persisted data, or downstream records that the consumer would normally produce.
• The consumer process can be crashed or rendered unresponsive, disrupting message processing pipelines that depend on it.