CVE-2026-116593— Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Quick assessment

Affected

Apache Software Foundation Apache Kafka

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Kafka Connect 在其 REST API 中提供了端点，用于验证连接器配置。同时，Kafka Connect 支持配置提供者（Configuration Providers），该功能可隐藏敏感配置项的值，并仅在运行时进行解析。若攻击者能够访问该验证端点，便可利用已安装在 Connect 工作节点上的任意配置提供者，解析并返回明文配置值。建议用户将版本升级至 4.2.2、4.3.2、4.4.0 或更高版本，以修复此漏洞。

AI Predicted 7.5 Difficulty: Easy Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1003 · OS Credential Dumping T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache Kafka	`2.4.0< 4.2.2`	affected
		`4.3.0< 4.3.2`	affected

Updated Oct 29, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Source: CVE Program / CVE List V5

Vulnerability Description

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Kafka	2.4.0 ~ 4.2.2	-

II. Public POCs for CVE-2026-116593

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116593

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-116593

Same Patch Batch · Apache Software Foundation · 2026-10-28 · 12 CVEs total

CVE-2026-114349		Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed r
CVE-2026-112375		Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterC
CVE-2026-115644		Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
CVE-2026-111551		Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded me
CVE-2026-111496		Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctua
CVE-2026-111115		Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexibl
CVE-2026-111108		Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated
CVE-2026-111073		Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size lim
CVE-2026-110985		Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when t
CVE-2026-110952		Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEA
CVE-2026-83525		Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated

IV. Related Vulnerabilities

Same product: Apache Kafka

Same vendor: Apache Software Foundation