While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain). The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will     not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides     to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs     associated with it after the removal. When those two preconditions are met, Kafka will treat the resource     as if it had only one ACL associated with it after the removal, rather than the two or more that would be     correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to     the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).
    The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the     impact would be limited to availability impact. if DENY ACLs were configured, the impact could include     confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored     due to this vulnerability during the migration period. (CVE-2024-27309)

Note that Nessus relies on the presence of the package as reported by the vendor.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (Apache Tomcat)).  Supported versions that are affected are 25.0-25.5. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. (CVE-2025-24813)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI (JDOM)).
    Supported versions that are affected are 25.0-25.5. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Siebel CRM Integration. (CVE-2021-33813)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and     Subscribe (Apache Kafka)).  Supported versions that are affected are 25.0-25.5. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM     Integration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or     modification access to critical data or all Siebel CRM Integration accessible data as well as  unauthorized     access to critical data or complete access to all Siebel CRM Integration accessible data. (CVE-2024-27309)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will
    not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides
    to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs
    associated with it after the removal. When those two preconditions are met, Kafka will treat the resource
    as if it had only one ACL associated with it after the removal, rather than the two or more that would be
    correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to
    the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).
    The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the
    impact would be limited to availability impact. if DENY ACLs were configured, the impact could include
    confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored
    due to this vulnerability during the migration period. (CVE-2024-27309)

ID	Name	Product	Family	Severity
250894	Linux Distros Unpatched Vulnerability : CVE-2024-27309	Nessus	Misc.	high
242243	Oracle Siebel CRM 25.x < 25.6 (July 2025 CPU)	Nessus	Misc.	critical
411978	SCA: security update for org.apache.kafka:kafka-metadata (GHSA-79vv-vp32-gpp7)	Tenable Cloud Security	SCA Checks	high
411978	SCA: security update for org.apache.kafka:kafka-metadata (GHSA-79vv-vp32-gpp7)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2024-27309

high

Tenable Plugins

high

critical

high

high