Unauthenticated root RCE hits Confluent ksqlDB 7.9.1-ce defaults

A research group has publicly detailed a pre-authentication remote code execution flaw in Confluent Platform 7.9.1-ce that, in the product’s default layout, lets an unauthenticated attacker run commands as root on the host.

According to the 0day Rubbish Research Team, ksqlDB, the Kafka broker in plaintext mode, and Kafka Connect all accept unauthenticated requests out of the box. An attacker can issue a CREATE SINK CONNECTOR statement that points FileStreamSinkConnector at a path they choose, then push arbitrary bytes onto the related topic through the open broker. The connector appends those messages to the target file. Writing a cron entry under /etc/cron.d is enough for command execution as root when crond runs; the team reports verifying uid 0.

The issue is scored CVSS 9.8. No credentials are required. Successful abuse yields arbitrary commands as the ksqlDB/Connect process user, which the advisory states is root, so an attacker can read or destroy host data, persist, and take over the Confluent deployment.

Operators running stock 7.9.1-ce with those services exposed should treat the stack as fully compromised until authentication is enforced on ksqlDB, the broker, and Connect, sink connector creation is locked down, and any unexpected connectors or cron material are removed. The finding was posted to the Full Disclosure list with a public proof-of-concept.