CVE-2025-30677
Last modified
CVE-2025-30677 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. EPSS estimates a 0.57% chance of exploitation in the next 30 days.
Description
Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue. This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4. 3.0.x version users should upgrade to at least 3.0.11. 3.3.x version users should upgrade to at least 3.3.6. 4.0.x version users should upgrade to at least 4.0.4. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Pulsar | >= 2.3.0, < 3.0.11 |
| Apache | Pulsar | >= 3.3.0, < 3.3.6 |
| Apache | Pulsar | >= 4.0.0, < 4.0.4 |
References
- https://lists.apache.org/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3dMailing List, Vendor Advisory
- https://pulsar.apache.org/security/Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/04/09/2Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-30677?
How severe is CVE-2025-30677?
How do I fix CVE-2025-30677?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-30670Null pointer dereference in some Zoom Workplace Apps for Win…6.5
- CVE-2025-30671Null pointer dereference in some Zoom Workplace Apps for Win…6.5
- CVE-2025-30672Mite for Perl before 0.013000 generates code with the curren…6.5
- CVE-2025-30673Sub::HandlesVia for Perl before 0.050002 allows untrusted co…6.5
- CVE-2025-30675In Apache CloudStack, a flaw in access control affects the l…4.7
- CVE-2025-30676Improper Neutralization of Script-Related HTML Tags in a Web…6.1
- CVE-2025-30678A Server-side Request Forgery (SSRF) vulnerability in Trend …7.5
- CVE-2025-30679A Server-side Request Forgery (SSRF) vulnerability in Trend …7.5
- CVE-2025-3068Inappropriate implementation in Intents in Google Chrome on …8.8
- CVE-2025-30680A Server-side Request Forgery (SSRF) vulnerability in Trend …7.1
- CVE-2025-30681Vulnerability in the MySQL Server product of Oracle MySQL (c…2.7
- CVE-2025-30682Vulnerability in the MySQL Server product of Oracle MySQL (c…6.5
Are you affected by CVE-2025-30677?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST