Azure kafka-sink-azure-kusto up to 5.2.2 Connector Configuration data query logic injection

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Azure kafka-sink-azure-kusto up to 5.2.2. Affected by this issue is some unknown functionality of the component Connector Configuration Handler. This manipulation causes data query logic injection. This vulnerability is handled as CVE-2026-42316. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Azure kafka-sink-azure-kusto up to 5.2.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Connector Configuration Handler. The manipulation with an unknown input leads to a data query logic injection vulnerability. The CWE definition for the vulnerability is CWE-943. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer (Kusto). Prior to 5.2.3, kafka-sink-azure-kusto did not sanitize user-controlled values inside the kusto.tables.topics.mapping configuration. The db, table, mapping, and format fields of each mapping entry were interpolated directly into KQL management/query commands via String.formatted(...) (e.g., FETCH_TABLE_COMMAND.formatted(table) → " | count", FETCH_TABLE_MAPPING_COMMAND.formatted(table, format, mapping) → ".show table ingestion mapping ''"). An actor able to influence the connector configuration (for example, someone with permissions to submit or edit Kafka Connect connector configs) could embed KQL metacharacters (;, |, ') to execute arbitrary management commands in the context of the connector's service principal — enabling schema enumeration/modification, ingestion-mapping tampering, or changes to streaming/retention policies on the target Azure Data Explorer database. This is a tampering vulnerability. Exploitation requires privileged access to the connector configuration; no end-user interaction or Kafka record payload is involved. This vulnerability is fixed in 5.2.3.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-42316 since 04/26/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 5.2.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Azure

Name

• kafka-sink-azure-kusto

Version

• 5.2.0
• 5.2.1
• 5.2.2

Website

• Product: https://github.com/Azure/kafka-sink-azure-kusto/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion