User:ANONYMOUS
The principal Kafka gives a connection that did not authenticate.
A PLAINTEXT listener, or an SSL listener without client authentication, names every client User:ANONYMOUS. ACLs written for real user names then do not match it, so its requests are denied unless an ACL allows it.