github.com/apache/kafka
Submitted 8/4/2026, 10:28:01 AM · Status: ok
Risk grade
F
100 / 100
Findings
92
0 critical23 high65 medium4 low0 info0 on CISA KEV0ATT&CK
Showing 92 of 92 findings
Findings
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected jwt: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user dataUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.gitleaks
- Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryptionIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.gitleaks
- Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryptionIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.gitleaks
- Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryptionIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.gitleaks
- Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryptionIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.gitleaks
- Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryptionIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.gitleaks
- Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryptionIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.gitleaks
- Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret stCommitted PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/assertion/AssertionUtils.java:67
- Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret stCommitted PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/assertion/AssertionUtils.java:69
- Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret stCommitted PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/security/ssl/DefaultSslEngineFactory.java:552
- pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)semgrep.github/scripts/develocity_reports.py:112
- subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list ansubprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)semgrepcommitter-tools/kafka-merge-pr.py:104
- yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)semgrepcommitter-tools/refresh_collaborators.py:124
- 'apt-get' missing '--no-install-recommends''apt-get' install should use '--no-install-recommends' to minimize image size.trivytests/docker/Dockerfile:148
- 'dnf clean all' missingCached package data should be cleaned after installation to reduce image size.trivydocker/native/Dockerfile:33
- 'microdnf clean all' missingCached package data should be cleaned after installation to reduce image size.trivydocker/native/Dockerfile:33
- 'RUN <package-manager> update' instruction aloneThe instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.trivydocker/jvm/Dockerfile:71
- 'RUN <package-manager> update' instruction aloneThe instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.trivydocker/jvm/Dockerfile:31
- 'RUN <package-manager> update' instruction aloneThe instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.trivydocker/docker_official_images/3.7.0/jvm/Dockerfile:28
- 'RUN <package-manager> update' instruction aloneThe instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.trivydocker/docker_official_images/3.7.0/jvm/Dockerfile:62
- 'RUN <package-manager> update' instruction aloneThe instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.trivydocker/native/Dockerfile:59
- Ensure that APT isn't usedEnsure that APT isn't used on /tests/docker/Dockerfile.RUNcheckovtests/docker/Dockerfile:34
- Ensure that HEALTHCHECK instructions have been added to container imagesEnsure that HEALTHCHECK instructions have been added to container images on /tests/docker/Dockerfile.checkovtests/docker/Dockerfile:1
- Ensure that HEALTHCHECK instructions have been added to container imagesEnsure that HEALTHCHECK instructions have been added to container images on /docker/docker_official_images/3.7.0/jvm/Dockerfile.checkovdocker/docker_official_images/3.7.0/jvm/Dockerfile:1
- Ensure that HEALTHCHECK instructions have been added to container imagesEnsure that HEALTHCHECK instructions have been added to container images on /docker/native/Dockerfile.checkovdocker/native/Dockerfile:1
- Ensure that HEALTHCHECK instructions have been added to container imagesEnsure that HEALTHCHECK instructions have been added to container images on /docker/jvm/Dockerfile.checkovdocker/jvm/Dockerfile:1
- Ensure that sudo isn't usedEnsure that sudo isn't used on /tests/docker/Dockerfile.RUNcheckovtests/docker/Dockerfile:34
- Ensure the base image uses a non latest version tagEnsure the base image uses a non latest version tag on /tests/docker/Dockerfile.FROMcheckovtests/docker/Dockerfile:17
- Ensure the base image uses a non latest version tagEnsure the base image uses a non latest version tag on /docker/native/Dockerfile.FROMcheckovdocker/native/Dockerfile:47
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Pull Request Linter)checkov.github/workflows/pr-linter.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Check and Test)checkov.github/workflows/build.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Pull Request Reviewed)checkov.github/workflows/pr-reviewed.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Fixup PR Labels)checkov.github/workflows/pr-labels-cron.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Workflow Requested)checkov.github/workflows/workflow-requested.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Docker Prepare Docker Official Image Source)checkov.github/workflows/prepare_docker_official_image_source.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Pull Request)checkov.github/workflows/pr-update.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Reviewers Trailer (on review))checkov.github/workflows/pr-reviewers-trailer-on-review.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Pull Request Labeled)checkov.github/workflows/pr-labeled.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Flaky Test Report)checkov.github/workflows/generate-reports.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Docker Image CVE Scanner)checkov.github/workflows/docker_scan.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Build and Push Release Candidate Docker Image)checkov.github/workflows/docker_rc_release.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Promote Release Candidate Docker Image)checkov.github/workflows/docker_promote.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Docker Official Image Build Test)checkov.github/workflows/docker_official_image_build_and_test.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Docker Build Test)checkov.github/workflows/docker_build_and_test.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Deflake a test)checkov.github/workflows/deflake.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(CI Complete)checkov.github/workflows/ci-complete.yml:13
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Stale PRs)checkov.github/workflows/stale.yml:22
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Docker Prepare Docker Official Image Source)checkov.github/workflows/prepare_docker_official_image_source.yml:21
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Build and Push Release Candidate Docker Image)checkov.github/workflows/docker_rc_release.yml:21
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Promote Release Candidate Docker Image)checkov.github/workflows/docker_promote.yml:21
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Docker Official Image Build Test)checkov.github/workflows/docker_official_image_build_and_test.yml:21
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Docker Build Test)checkov.github/workflows/docker_build_and_test.yml:21
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Deflake a test)checkov.github/workflows/deflake.yml:20
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:82
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:89
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:93
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepserver/src/testFixtures/java/org/apache/kafka/security/minikdc/MiniKdc.java:480
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepstorage/src/main/java/org/apache/kafka/server/log/remote/metadata/storage/serialization/RemoteLogMetadataSerde.java:103
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:86
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/config/SaslConfigs.java:190
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/requests/ApiVersionsResponse.java:315
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/requests/RequestContext.java:123
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/requests/RequestHeader.java:165
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepclients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java:129
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepclients/src/testFixtures/java/org/apache/kafka/common/security/authenticator/TestJaasConfig.java:40
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepclients/src/testFixtures/java/org/apache/kafka/common/security/authenticator/TestJaasConfig.java:55
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepcommitter-tools/README.md:78
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepcommitter-tools/README.md:80
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepconfig/consumer.properties:116
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepconfig/producer.properties:111
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocker/examples/fixtures/client-secrets/client-sasl.properties:20
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocker/examples/fixtures/sasl/broker_jaas.conf:19
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:42
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:45
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:233
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:263
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:295
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:331
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:359
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:762
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/security/authentication-using-sasl.md:863
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepmetadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java:145
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepmetadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java:235
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgreprelease/release.py:237
- ':latest' tag usedWhen using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.trivydocker/native/Dockerfile:47
- 'RUN cd ...' to change directoryUse WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.trivytests/docker/Dockerfile:149
This report is public.