Client or Server? Hidden Sword of Damocles in Kafka
Ji'an Zhou, Ying Zhu, ZiYang Li
DEF CON 33 · Day 2 · Main Stage
Apache Kafka is the backbone of modern data-intensive architectures. Deployed by thousands of enterprises for real-time data pipelines, event streaming, and critical application integration, a single
AI review
Kafka's client/server identity ambiguity yields replication impersonation, ZooKeeper control plane RCE chains, KRaft new-surface bugs, and SSRF in Connect — a systematic attack surface analysis that covers both control plane implementations.