CVE-2026-115644 in Kafka
Summary
by MITRE • 10/28/2026
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.
When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.
While the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.
Impact:
An unauthenticated attacker with network access to the admin listener can:
1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use. 2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress logging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.
Mitigation:
Users who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the REST extensions specified via "rest.extension.classes" will also apply to "admin.listeners".
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
Apache Kafka Connect contains a critical authentication bypass vulnerability within its admin REST API that arises from an architectural misconfiguration when administrators attempt to isolate administrative traffic. The flaw specifically affects deployments where the admin listeners are configured with a separate listener distinct from the main listeners property via the admin.listeners configuration parameter. In such configurations, security extensions defined through rest.extension.classes, including widely used implementations like BasicAuthSecurityRestExtension, fail to register or apply their authentication and authorization filters to the administrative resource endpoints. This creates a significant security gap where the primary REST API correctly enforces configured security policies, but the isolated admin listener operates without these protective mechanisms, effectively leaving sensitive management interfaces exposed to unauthenticated access if network segmentation is not strictly enforced at the infrastructure level rather than relying solely on application-level configuration.
The technical root cause lies in how Kafka Connect initializes its HTTP server components and applies extension classes during startup. When a separate admin listener is explicitly defined, the framework instantiates a distinct set of resources for administrative tasks without inheriting the security context established by the main listeners. Consequently, endpoints mounted under this isolated path, particularly those related to dynamic log configuration such as /admin/loggers, do not instantiate or check the configured authentication filters. This design oversight means that any request directed at these admin endpoints is processed directly by the underlying servlet container without passing through the intended security gatekeepers, allowing requests from unauthenticated sources to execute administrative functions with full privileges provided they can reach the network port associated with the admin listener.
The operational impact of this vulnerability is severe and multifaceted, affecting both confidentiality and availability within a Kafka Connect cluster. An attacker with basic network access to the designated admin listener port can exploit this flaw to read the complete set of logger names and their current levels. This disclosure reveals sensitive internal details about the system architecture, including loaded class names and specific security extensions currently in use, which aids further reconnaissance. More critically, the vulnerability allows unauthenticated write operations to modify logger levels with a scope that applies cluster-wide. By setting the root logger level to OFF, an attacker can suppress all logging across every worker node, effectively blinding operators to ongoing activities and errors while potentially masking malicious actions or system failures. Conversely, setting the log level to TRACE generates excessive verbose output, which can rapidly consume disk space and CPU resources, leading to a denial of service condition that degrades performance or causes complete unavailability of the Kafka Connect cluster due to resource exhaustion.
This vulnerability aligns with CWE-287 Improper Authentication as it allows unauthorized actors to bypass authentication mechanisms intended for administrative interfaces. It also maps to MITRE ATT&CK techniques such as T1078 Valid Accounts if an attacker leverages discovered credentials, or more directly T1562 Impair Defenses by disabling logging capabilities through the logger manipulation feature. The ability to suppress logs is particularly dangerous in security incident response scenarios where audit trails are essential for forensic analysis and compliance reporting. Furthermore, the potential for denial of service via log flooding represents a significant risk to operational stability, impacting the reliability of data ingestion pipelines that depend on Kafka Connect.
To mitigate this issue immediately without upgrading software versions, administrators should remove or unset the admin.listeners configuration property in their Kafka Connect worker configurations. When this property is left undefined, the administrative resources default to sharing the regular listener configured via listeners, thereby inheriting all associated security extensions and authentication filters automatically. This ensures that both standard API endpoints and administrative management interfaces are protected by the same rigorous access control policies. For long-term resolution, organizations must upgrade their Kafka Connect instances to version 4.2.2, 4.3.2, or 4.4.0 and later, where the developers have corrected this architectural flaw by ensuring that REST extensions specified via rest.extension.classes are consistently applied across all listener configurations including those designated for administrative tasks. This patch restores the intended security boundary between untrusted network traffic and sensitive cluster management operations.