Credential Exposure in Splunk Connect for Kafka via HEC Configuration

Splunk Connect for Kafka versions below 2.2.7 contain a vulnerability (CVE-2026-76402) that permits an unauthenticated user with network access to the Kafka Connect REST API to perform unauthorized configuration changes. The flaw stems from insufficient validation of HTTP Event Collector (HEC) endpoints, specifically the lack of mandatory secure transport (HTTPS) for these connections. By reconfiguring the HEC endpoint to an attacker-controlled server, the connector can be coerced into transmitting sensitive authentication credentials and data streams to an external, unauthorized host. This exposure compromises the confidentiality of data passing through the connector and allows for the modification of event delivery paths. Defenders should prioritize updating affected Splunk Connect for Kafka deployments to version 2.2.7 or later to enforce secure HEC configuration.

Impact

Successful exploitation leads to the exposure of HEC authentication credentials and the interception or manipulation of sensitive data streams within the Kafka to Splunk ingestion pipeline. This results in significant risks to data integrity and unauthorized access to downstream Splunk Enterprise environments.

Recommendation

• Upgrade Splunk Connect for Kafka to version 2.2.7 or higher immediately to address CVE-2026-76402.
• Audit existing Kafka Connect REST API configurations for non-standard or unauthorized HEC endpoint URLs that utilize HTTP instead of HTTPS.
• Restrict network access to the Kafka Connect REST API to authorized management IP addresses only, preventing unauthenticated reachability from the broader network.