Security Review: Network Exposure Risk in docker-compose.yml

[youming1970]

👋 Hi Confluent team,

I've been reviewing your cp-all-in-one Docker Compose configuration and noticed some potential security considerations for production deployments.

Security Findings

P1: Network Exposure Risk

Location: cp-all-in-one/docker-compose.yml:28

KAFKA_LISTENERS: 'PLAINTEXT://broker:29092,CONTROLLER://broker:29093,PLAINTEXT_HOST://0.0.0.0:9092'

Risk: The Kafka broker listens on all interfaces (0.0.0.0:9092), which could expose the service to external networks in production environments.

Suggested Fix: Bind to localhost for development use:

KAFKA_LISTENERS: 'PLAINTEXT://broker:29092,CONTROLLER://broker:29093,PLAINTEXT_HOST://127.0.0.1:9092'

P2: Unencrypted Communication

The configuration uses PLAINTEXT protocols throughout, which is appropriate for development but could be misleading for production deployments.

Impact Assessment

• Scope: 1,075+ stars, widely used for Kafka evaluation
• Risk: Developers might deploy this configuration to production
• Benefit: Enhanced security guidance for the Kafka community

Offer

We specialize in configuration security reviews and would be happy to provide:

• Complete security analysis of all Docker Compose files
• Production-ready SSL/SASL configuration examples
• 24-hour turnaround professional security report

Would you be interested in a complimentary detailed security review?

Contact: youming@flowspec.org
Service: Configuration Risk Assessment

Best regards,
Configuration Security Review Team

[aravindan888]

Can i work on this?

[youming1970]

Hi @aravindan888,

Thank you for your proactive approach to this security issue. As the third-party auditor who identified this vulnerability, we strongly encourage you to develop a fix.

Since we are not the project maintainers, we cannot officially assign this issue. That decision will need to come from the confluentinc team. I am tagging some of the maintainers so they are aware of your offer.

Once you submit a Pull Request, our team would be happy to review it from a security perspective to help validate the effectiveness of the fix.

cc @davetroiano — A community member is offering to fix this security exposure issue.

Best regards,
Configuration Security Review Team