[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feXx3LXr4ZKms1RMRlQGsLi5ddtJE9biPYO-HRww7w_E":3,"g5a-risk:CVE-2026-41115":113},{"success":4,"data":5,"meta":110},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":32,"epssPercentile":26,"epssTimeSeries":33,"severity":34,"affectedProducts":35,"affectedProductsCount":41,"references":42,"referencesCount":54,"weaknesses":55,"weaknessesCount":41,"isActivelyExploited":64,"cisaInfo":26,"otxData":26,"relatedBlogPosts":65,"seoMetadata":66,"configurations":91,"relatedVendorCves":101,"notableEvents":102},"CVE-2026-41115","What is CVE-2026-41115?","An improper authorization vulnerability has been identified in Apache Kafka.\n\nThe implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join\u002Fsync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.\n\nThe correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.","An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIB...","2026-06-02T10:16:25.107","2026-07-22T19:10:00.12",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":29,"CVSSMetricV2":30,"CVSSMetricV40":31},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","MEDIUM",null,2.8,1.4,[],[],[],0.00454,[32,32,32,32,32,32,32],"Medium",[36],{"vendor":37,"product":38,"version":39,"criteria":40,"vulnerable":4},"apache","kafka","*","cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*",1,[43,48],{"url":44,"source":45,"tags":46},"https:\u002F\u002Fkafka.apache.org\u002Fcve-list","Apache",[47],"Vendor Advisory",{"url":49,"source":50,"tags":51},"http:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F06\u002F02\u002F5","Openwall",[52,53],"Mailing List","Third Party Advisory",2,[56],{"id":57,"name":58,"description":59,"extendedDescription":60,"status":61,"abstraction":62,"structure":63},"CWE-285","Improper Authorization","The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.","Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.\nWhen access control checks are not applied consistently - or not at all - users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.","Draft","Class","Simple",false,[],{"title":67,"metaDescription":68,"keywords":69,"canonicalUrl":70,"structuredData":71},"What is CVE-2026-41115? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2026-41115, a medium severity cyber security vulnerability from 2026. An improper authorization vulnerability has been identifi...","CVE-2026-41115, CVE-2026-41115 vulnerability, CVE-2026-41115 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, apache security, kafka vulnerability","\u002Fwhat-is\u002Fcve-2026-41115",{"@context":72,"@type":73,"headline":67,"description":68,"datePublished":10,"dateModified":11,"author":74,"publisher":78,"about":82,"mainEntityOfPage":86,"articleSection":89,"keywords":90},"https:\u002F\u002Fschema.org","TechArticle",{"@type":75,"name":76,"url":77},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":75,"name":76,"url":77,"logo":79},{"@type":80,"url":81},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":83,"name":6,"description":84,"additionalType":85},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":87,"@id":88},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2026-41115","Cybersecurity","CVE-2026-41115, CVE-2026-41115 vulnerability, CVE-2026-41115 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[92],{"Operator":26,"Negate":26,"Nodes":93},[94],{"Operator":95,"Negate":64,"CPEMatch":96},"OR",[97],{"Vulnerable":4,"Criteria":40,"MatchCriteriaID":98,"VersionStartExcluding":26,"VersionStartIncluding":99,"VersionEndExcluding":26,"VersionEndIncluding":100},"61D7227C-2896-457A-AE72-7D2957DACF19","4.0.0","4.3.0",[],[103],{"id":104,"eventType":105,"eventTime":106,"details":107,"label":108,"color":109},"15c9b92d-821f-40c4-bfb6-9ade1c7bc30c","NEW_NVD","2026-06-03T04:01:13.435501+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":111,"version":112},1792243699270,"2.0",{"score":114,"band":115,"action":116,"scoredAt":117},25,"Low","Monitor","2026-10-16T07:13:53.371546+00:00"]