CVE-2026-76402 in Connect for Kafka
Summary
by MITRE • 08/19/2026
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise that causes the connector to send authentication credentials to an attacker-controlled server, allowing for exposure of credentials that compromise all relevant data sent through the connector and limited alteration of event delivery. The vulnerability is possible because HTTP Event Collector endpoint validation does not require secure transport by default. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
Splunk Connect for Kafka versions prior to 2.2.7 contain a critical security vulnerability that allows unauthenticated attackers with network access to the Kafka Connect REST API to exfiltrate sensitive authentication credentials. This flaw stems from an insufficient validation of endpoint configurations, specifically regarding the transport protocol used by the Splunk Enterprise HTTP Event Collector. By default, the connector does not enforce secure transport requirements when validating or accepting configuration parameters for data ingestion endpoints. Consequently, a remote attacker who can interact with the Kafka Connect REST API can manipulate these settings to redirect event traffic away from legitimate Splunk infrastructure and toward a server under their control.
The technical mechanism of this vulnerability relies on the ability to configure an HTTP Event Collector endpoint using plain Hypertext Transfer Protocol rather than HTTPS. When such a non-secure configuration is applied, all data transmitted through the connector, including authentication tokens and credentials required for subsequent interactions with Splunk Enterprise, is sent in cleartext. This lack of encryption allows network observers or specifically targeted attackers to intercept these credentials via standard man-in-the-middle techniques or by simply monitoring traffic directed to their controlled server. The exposure of these credentials represents a severe compromise of the integrity and confidentiality of the data pipeline, as valid authentication tokens can be reused to access Splunk Enterprise resources directly, bypassing other security controls that might rely on this specific connector's operational context.
The operational impact of this vulnerability is significant, affecting both the confidentiality and availability aspects of the affected systems. The primary consequence is the exposure of credentials that compromise all relevant data sent through the compromised connector. Attackers can harvest these tokens to gain unauthorized access to Splunk Enterprise instances, potentially leading to further lateral movement within the organization's security infrastructure. Additionally, while the vulnerability primarily facilitates credential theft, it also allows for limited alteration of event delivery. An attacker could manipulate configuration parameters to disrupt normal data ingestion processes or inject malicious events into the logging pipeline, thereby degrading the reliability and trustworthiness of the security monitoring capabilities provided by Splunk Enterprise.
This issue aligns with CWE-319, which describes cleartext transmission of sensitive information over an unprotected communication channel, as well as CWE-284 regarding improper access control that permits unauthenticated users to perform administrative actions via the REST API. From a threat modeling perspective using MITRE ATT&CK, this vulnerability facilitates Credential Access through techniques such as Network Sniffing or Intercepted Authentication Credentials, and potentially contributes to Initial Access if those harvested credentials are used to pivot into other systems. The root cause is identified as CWE-20, Improper Input Validation, where the system fails to enforce security constraints on configuration inputs related to transport protocols.
To mitigate this risk, organizations running Splunk Connect for Kafka must immediately upgrade to version 2.2.7 or later, which addresses the validation logic to ensure secure transport is enforced by default. In environments where upgrading is not immediately feasible, administrators should implement strict network segmentation and firewall rules to restrict access to the Kafka Connect REST API exclusively from trusted management networks with strong authentication mechanisms in place. Furthermore, it is advisable to configure Splunk Enterprise HTTP Event Collector endpoints to reject non-HTTPS connections at the server level, adding a secondary layer of defense that prevents cleartext credential transmission even if an attacker manages to manipulate connector configurations. Regular auditing of configuration files and monitoring for unusual outbound traffic patterns can also help in detecting potential exploitation attempts before significant damage occurs.