---
id: "CVE-2026-116593"
kind: "vulnerability"
aliases: ["CVE-2026-116593"]
title: "Apache Kafka Connect: validate endpoint leaks config provider secrets in plaintext"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kafka", "kafka-connect", "package", "self-hosted"]
not_affected_if: ["no-config-providers", "rest-api-restricted"]
published_at: "2026-10-28T17:18:00+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:35:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116593", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Apache Kafka Connect: validate endpoint leaks config provider secrets in plaintext

The Kafka Connect REST endpoint for validating connector configurations resolves values from installed configuration providers and returns them in plaintext. An attacker who can reach that endpoint can read secrets that providers are meant to hide until runtime.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Kafka version the Connect worker runs with `kafka-topics.sh --version` or the version in the image or package manager.
- Confirm whether the REST API is reachable beyond trusted hosts, for example by checking the `listeners` and `rest.advertised.host.name` settings in the Connect worker config.
- Check whether `config.providers` is set in the Connect worker config; if it is unset, the endpoint has no providers to leak from.

## Fix

- Upgrade Apache Kafka Connect to `4.2.2`, `4.3.2`, `4.4.0` or later.
- Restrict access to the Connect REST API to trusted operators until the upgrade is applied.
- Rotate any secrets that were resolved through configuration providers on a worker that was reachable by untrusted users.

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116593

## From the sources

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations.
Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. 

An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker.

Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_