{"id":"CVE-2026-116593","kind":"vulnerability","aliases":["CVE-2026-116593"],"related":[],"title":"Apache Kafka Connect: validate endpoint leaks config provider secrets in plaintext","description":"Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations.\nApache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. \n\nAn attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker.\n\nUsers are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.","summary":"The Kafka Connect REST endpoint for validating connector configurations resolves values from installed configuration providers and returns them in plaintext. An attacker who can reach that endpoint can read secrets that providers are meant to hide until runtime.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kafka","kafka-connect","package","self-hosted"],"not_affected_if":["no-config-providers","rest-api-restricted"],"how_to_check":"- Check the Kafka version the Connect worker runs with `kafka-topics.sh --version` or the version in the image or package manager.\n- Confirm whether the REST API is reachable beyond trusted hosts, for example by checking the `listeners` and `rest.advertised.host.name` settings in the Connect worker config.\n- Check whether `config.providers` is set in the Connect worker config; if it is unset, the endpoint has no providers to leak from.","fix":"- Upgrade Apache Kafka Connect to `4.2.2`, `4.3.2`, `4.4.0` or later.\n- Restrict access to the Connect REST API to trusted operators until the upgrade is applied.\n- Rotate any secrets that were resolved through configuration providers on a worker that was reachable by untrusted users.","status":"open","published_at":"2026-10-28T17:18:00+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:35:02+00:00","updated_at":"2026-10-28T17:35:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:35:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Kafka Connect to `4.2.2`, `4.3.2`, `4.4.0` or later.\n- Restrict access to the Connect REST API to trusted operators until the upgrade is applied.\n- Rotate any secrets that were resolved through configuration providers on a worker that was reachable by untrusted users.","reach":"network","title":"Apache Kafka Connect: validate endpoint leaks config provider secrets in plaintext","impact":"medium","summary":"The Kafka Connect REST endpoint for validating connector configurations resolves values from installed configuration providers and returns them in plaintext. An attacker who can reach that endpoint can read secrets that providers are meant to hide until runtime.","category":"package","nicknames":[],"who_cares":["kafka","kafka-connect","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Secrets resolved by configuration providers are readable as plaintext via the endpoint.","analyst_note":"Confirm the affected version range and whether the validate endpoint requires authentication, using the Apache Kafka security advisory or the NVD entry.","how_to_check":"- Check the Kafka version the Connect worker runs with `kafka-topics.sh --version` or the version in the image or package manager.\n- Confirm whether the REST API is reachable beyond trusted hosts, for example by checking the `listeners` and `rest.advertised.host.name` settings in the Connect worker config.\n- Check whether `config.providers` is set in the Connect worker config; if it is unset, the endpoint has no providers to leak from.","needs_analyst":true,"not_affected_if":["no-config-providers","rest-api-restricted"],"who_is_affected":"Teams that run Apache Kafka Connect workers with configuration providers installed, where the REST API is reachable by someone other than trusted operators. Deployments with no configuration providers or with the REST API limited to trusted hosts are less exposed. The sources do not say which Kafka versions before the fix are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":3404,"output_tokens":733,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116593':14A,17A '-2026':13A,16A '/config/validate':73C '/connector-plugins':69C '4.2.2':140C '4.3.2':141C '4.4.0':142C 'access':108C 'also':86C 'apach':1A,64C,83C 'api':78C 'attack':47B,106C 'config':7A 'configur':34B,39B,82C,88C,98C,126C 'connect':3A,21B,28B,66C,85C,131C 'connector':33B,71C,81C 'connector-typ':70C 'cve':12A,15A 'enabl':91C 'endpoint':5A,30B,52B,74C,112C 'fix':146C 'hide':61B,93C 'host':25B 'instal':38B,128C 'issu':148C 'kafka':2A,18B,20B,27B,65C,84C 'kafka-connect':19B 'leak':6A 'meant':59B 'packag':22B 'plaintext':11A,45B,120C 'provid':8A,40B,57B,89C,127C 'reach':50B 'read':54B 'recommend':135C 'resolv':35B,101C,117C 'rest':29B,77C 'return':42B,119C 'runtim':63B,104C 'secret':9A,55B 'self':24B 'self-host':23B 'sensit':97C 'support':87C 'type':72C 'upgrad':137C 'use':114C 'user':133C 'valid':4A,32B,80C,111C 'valu':36B,95C,121C 'version':139C 'via':122C 'worker':132C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Apache Kafka Connect workers with configuration providers installed, where the REST API is reachable by someone other than trusted operators. Deployments with no configuration providers or with the REST API limited to trusted hosts are less exposed. The sources do not say which Kafka versions before the fix are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116593","severity":null,"published_at":"2026-10-28T17:18:00+00:00","modified_at":"2026-10-28T17:18:00+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}