Security readout for executives and security teams
Plain-English summary
This issue affects Strimzi deployments using Kafka MirrorMaker/Kafka Connect REST APIs in version 0.41.0 and earlier. Weak access control could let an unauthenticated network attacker disrupt Kafka mirroring, copy mirrored topic data to another Kafka cluster, or expose Kafka SASL credentials.
Executive priority
Treat as urgent for exposed Strimzi MirrorMaker environments because the described impact includes service disruption, data exposure, and credential theft. Prioritize internet-facing or broadly reachable REST APIs first.
Technical view
CVE-2024-36543 is an incorrect access control flaw in the Kafka Connect REST API in Strimzi Project 0.41.0 and earlier. The CVE describes network, low-complexity, no-auth exploitation with potential confidentiality, integrity, and availability impact through MirrorMaker Kafka REST API access.
Likely exposure
Organizations using Strimzi 0.41.0 or earlier with Kafka MirrorMaker or Kafka Connect REST interfaces reachable by untrusted networks are the clearest exposure group. Evidence does not define affected CPEs.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. A public research reference exists, but the bundle does not establish real-world exploitation.
Researcher notes
The strongest evidence is the CVE description and CVSS 9.8 vector. The bundle does not name a fixed release, vendor advisory, CPEs, or confirmed exploitation. Avoid assuming affected products beyond Strimzi 0.41.0 and earlier.
Mitigation direction
- Inventory Strimzi deployments and identify versions 0.41.0 or earlier.
- Restrict Kafka Connect and MirrorMaker REST API access to trusted administrative networks.
- Review Strimzi project guidance for fixed versions or official mitigations.
- Rotate Kafka SASL credentials if unauthorized REST API access is suspected.
- Audit connector configurations for unauthorized mirroring destinations.
Validation and detection
- Confirm whether any Strimzi deployment runs version 0.41.0 or earlier.
- Check whether Kafka Connect or MirrorMaker REST APIs are externally reachable.
- Review connector inventory for unexpected or unauthorized connector definitions.
- Inspect logs for suspicious REST API access or connector changes.
- Verify Kafka ACLs do not substitute for REST API authorization controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-36543 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/almounah/vulnerability-research/tree/main/CVE-2024-36543CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.