CVE-2026-116593

HighCVSS 8.1

Published: 28/10/2026(UTC)Updated: 05/11/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

41th percentile - higher than 41% of all known CVEs

Summary

A vulnerability in Apache Kafka Connect affects the REST API endpoint /connector-plugins/{connector-type}/config/validate used to validate connector configurations. An attacker with access to this endpoint can leverage installed Configuration Providers to resolve and return plaintext values of sensitive configuration that should only be resolved at runtime.

Risk Assessment

Exposure of sensitive configuration values (such as passwords or API keys) to anyone with access to the Connect REST API may lead to credential compromise and further attack escalation within the environment.

Recommendation

Upgrade Apache Kafka Connect to version 4.2.2, 4.3.2, 4.4.0 or later, which fix this issue. Restrict access to the Connect REST API to trusted networks and users.

Other vulnerabilities in Apache Kafka Connect

CVE-2026-115644High
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured as a separate listener from the main listeners property. REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration, so the /admin/loggers endpoint accepts unauthenticated read and write requests.

Original NVD description (English source)

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS