Apache Kafka 3.2.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1 are affected.
No. On a cluster with an authorizer enabled, an authenticated principal with no authorization grants, including no ALTER_CONFIGS permission, can reach the vulnerable validation path.
The attacker needs to authenticate to Kafka and send an IncrementalAlterConfigs or AlterConfigs request targeting a BROKER resource. They can name a ConfigProvider in the request, such as FileConfigProvider or EnvVarConfigProvider, to resolve files accessible to the broker or broker environment variables.
The configuration validation occurs before authorization on this request path. That validation instantiates the requested ConfigProvider and bypasses the org.apache.kafka.automatic.config.providers allowlist.