CVE-2026-116593 in Kafka
Summary
by MITRE • 10/28/2026
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations.
Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime.
An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker.
Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
Apache Kafka Connect serves as a critical component in data streaming architectures by providing a scalable and reliable way to import and export data between Apache Kafka and other systems using connectors. A significant security flaw exists within the REST API endpoint designated for validating connector configurations, specifically /connector-plugins/{connector-type}/config/validate. This vulnerability arises from the interaction between this validation mechanism and the Configuration Providers feature introduced in recent versions of Kafka Connect. Configuration Providers are designed to allow users to store sensitive configuration values, such as passwords or API keys, outside of the connector definition files and resolve them at runtime using various backends like HashiCorp Vault, AWS Secrets Manager, or environment variables. The intended security model relies on these providers keeping secrets hidden from direct inspection in static configurations.
The technical flaw lies in how the validation endpoint processes configuration data before it is fully secured by the provider abstraction layer. When an authenticated user submits a connector configuration for validation via this REST API, the Kafka Connect worker attempts to resolve all placeholders and sensitive values using the installed Configuration Providers immediately during the validation phase. Instead of returning only structural or schema-related feedback about whether the configuration is valid, the endpoint inadvertently returns the fully resolved plaintext secrets alongside any error messages or success indicators. This behavior effectively bypasses the security boundary established by the Configuration Provider mechanism, exposing confidential credentials to anyone with access to this API endpoint.
The operational impact of this vulnerability is severe for organizations relying on Kafka Connect for sensitive data pipelines. An attacker who has obtained valid authentication credentials for the Kafka Connect REST interface can exploit this flaw to extract plaintext secrets from any connector configuration stored or managed by that worker. This includes database passwords, cloud service access keys, and other proprietary credentials required for data integration tasks. The exposure of these secrets can lead to unauthorized access to downstream systems, potential data breaches, and compromise of the broader infrastructure connected through Kafka Connect. Since validation is often a routine administrative task, this vulnerability could be triggered accidentally by legitimate users or intentionally by malicious actors with lower-level API access who might not have been expected to see sensitive configuration details.
Mitigation strategies primarily involve upgrading Apache Kafka Connect to version 4.2.2, 4.3.2, 4.4.0, or any later release where this issue has been addressed. In these patched versions, the validation logic is modified to prevent the resolution and exposure of sensitive values during the configuration check process. Until an upgrade can be performed, administrators should restrict network access to the Kafka Connect REST API using firewalls or reverse proxies that enforce strict authentication policies. Additionally, implementing role-based access control (RBAC) ensures that only authorized personnel with a legitimate need for administrative privileges can interact with connector configurations. It is also advisable to audit existing connectors and rotate any credentials that may have been exposed through this vulnerability in previous deployments.
This vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information about the environment or internal state, potentially aiding malicious attackers. Furthermore, it relates to CWE-798, involving the use of hardcoded credentials, as the flaw allows dynamic resolution and exposure of what should be treated as secret inputs rather than static values. From a threat modeling perspective consistent with MITRE ATT&CK techniques, this behavior facilitates Credential Access through API endpoints, specifically leveraging valid accounts to harvest secrets from application configuration data. Organizations must treat Kafka Connect REST APIs with the same level of security scrutiny applied to other sensitive administrative interfaces within their infrastructure.