CVE-2026-76402 in Connect for Kafka
摘要
由 VulDB • 2026-08-21
在Splunk Connect for Kafka低于2.2.7的版本中，能够访问Kafka Connect Representational State Transfer (REST) API的未认证用户可以在Splunk Enterprise中配置一个非安全的Hypertext Transfer Protocol (HTTP) Event Collector端点。这会导致连接器将身份验证凭据发送到攻击者控制的服务器，从而导致凭据泄露，进而危及通过该连接器发送的所有相关数据，并限制对事件传递的篡改。此漏洞之所以存在，是因为默认情况下HTTP Event Collector端点验证不要求使用安全传输协议。更多信息请参阅Splunk文档中的《Install Splunk Connect for Kafka》（https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka）、《Data ingestion parameters for Splunk Connect for Kafka》（https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka）以及《Set up and use HTTP Event Collector with configuration files》（https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files）。
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.