Live › vulnerability › CVE-2026-116593
Go to dashboardThe Kafka Connect REST endpoint for validating connector configurations resolves values from installed configuration providers and returns them in plaintext. An attacker who can reach that endpoint can read secrets that providers are meant to hide until runtime.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Teams that run Apache Kafka Connect workers with configuration providers installed, where the REST API is reachable by someone other than trusted operators. Deployments with no configuration providers or with the REST API limited to trusted hosts are less exposed. The sources do not say which Kafka versions before the fix are affected.
No product ranges from the sources yet.
kafka-topics.sh --version or the version in the image or package manager.listeners and rest.advertised.host.name settings in the Connect worker config.config.providers is set in the Connect worker config; if it is unset, the endpoint has no providers to leak from.4.2.2, 4.3.2, 4.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime.
An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker.
Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-116593")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.