CVE-2026-116593

Overview

Apache Kafka is an open-source distributed event streaming platform used for high-throughput, fault-tolerant data pipelines and stream processing. It stores records in partitioned, replicated, append-only logs on a cluster of brokers, and exposes producer, consumer, admin, Streams, and Connect APIs for publishing, subscribing to, and processing those records. The Java client and server components are published as Maven artifacts under org.apache.kafka.

An information exposure vulnerability (CVE-2026-116593) has been identified in the Kafka Connect REST API, which allows attackers with access to the /connector-plugins/{connector-type}/config/validate endpoint to read plaintext values from any configuration provider installed on a Connect worker. Configuration providers exist so that secrets such as passwords and keys are kept out of connector configurations and only resolved at runtime, so this exposes exactly the values they are meant to hide.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Apache Kafka, from 2.4.0 up to but not including 4.2.2, and 4.3.0 up to but not including 4.3.2.

Details

Module Info

• Product: Apache Kafka
• Affected packages: org.apache.kafka:connect-runtime
• Affected versions: >=2.4.0 <4.2.2, >=4.3.0 <4.3.2
• GitHub repository: https://github.com/apache/kafka
• Published packages: https://central.sonatype.com/artifact/org.apache.kafka/connect-runtime
• Package manager: Gradle
• Fixed in:
  • OSS Apache Kafka 4.2.2, 4.3.2, 4.4.0
  • NES for Apache Kafka

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.kafka:connect-runtime package in multiple versions of Apache Kafka. The Kafka Connect REST API exposes PUT /connector-plugins/{connectorType}/config/validate, which passes the submitted connector configuration to AbstractHerder.validateConnectorConfig. Before validating anything, that method runs the worker's configuration transformer over the caller's properties, replacing every ${provider:path:key} reference with the value returned by the matching configuration provider:

ConfigInfos validateConnectorConfig(Map<String, String> connectorProps, boolean doLog) {
    if (worker.configTransformer() != null) {
        connectorProps = worker.configTransformer().transform(connectorProps);
    }
    String connType = connectorProps.get(ConnectorConfig.CONNECTOR_CLASS_CONFIG);
    if (connType == null)
        throw new BadRequestException("Connector config " + connectorProps + " contains no connector type");
    ...
}

The resolved properties are then validated and returned to the caller. Each entry of the response is built from the resolved value, so a reference submitted in any validated property comes back as the secret it points to:

String value = ConfigDef.convertToString(configValue.value(), type);
...
return new ConfigValueInfo(configValue.name(), value, recommendedValues, configValue.errorMessages(), configValue.visible());

An attacker who can reach the validation endpoint can therefore submit a configuration such as "tasks.max": "${file:/etc/kafka/secrets.properties:db.password}" and read the resolved value, or any validation error that includes it, from the response. If the request omits connector.class, the BadRequestException message echoes the entire resolved property map.

Mitigation

Only recent versions of Apache Kafka are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. The Apache Kafka project does bugfix releases only for the last three minor releases; see the project's time-based release plan.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Kafka to a currently supported release that contains the fix, such as 4.2.2.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Hyunwoo Kim (finder)
• Sudhanshu Chauhan from RedHunt Labs (finder)
• Bartłomiej Dmitruk from Striga (finder)
• Andrew MacPherson (finder)