Skip to content
Threat Feed
Subscribe
high advisory

Apache Kafka: Unauthorized arbitrary file and environment variable read (CVE-2026-112375)

An authenticated principal in Apache Kafka can leverage crafted IncrementalAlterConfigs or AlterConfigs requests to perform arbitrary file and environment variable reads from the broker host.

CVE search metadata

CVE search record: CVE-2026-112375. KEV: no. Product: Kafka (3.2.0-4.1.2), Kafka (4.2.0-4.2.1), Kafka (4.3.0-4.3.1), Kafka (3.7.0-4.1.2), Kafka (4.3.0), Kafka (2.8.0 <= version < 4.2.2), Kafka (4.3.0 <= version < 4.3.2). Brief: Apache Kafka: Unauthorized arbitrary file and environment variable read (CVE-2026-112375). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-arbitrary-read/

CVE search record: CVE-2026-111073. KEV: no. Product: Kafka (3.2.0-4.1.2), Kafka (4.2.0-4.2.1), Kafka (4.3.0-4.3.1), Kafka (3.7.0-4.1.2), Kafka (4.3.0), Kafka (2.8.0 <= version < 4.2.2), Kafka (4.3.0 <= version < 4.3.2). Brief: Apache Kafka: Unauthorized arbitrary file and environment variable read (CVE-2026-112375). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-arbitrary-read/

CVE search record: CVE-2026-83525. KEV: no. Product: Kafka (3.2.0-4.1.2), Kafka (4.2.0-4.2.1), Kafka (4.3.0-4.3.1), Kafka (3.7.0-4.1.2), Kafka (4.3.0), Kafka (2.8.0 <= version < 4.2.2), Kafka (4.3.0 <= version < 4.3.2). Brief: Apache Kafka: Unauthorized arbitrary file and environment variable read (CVE-2026-112375). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-arbitrary-read/

Triage facts

Revision 1
Applicability
Kafka (3.2.0-4.1.2), Kafka (4.2.0-4.2.1) +5
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 28, 18:21 UTC
Vulnerabilities
3 CVEs
Source quality
A1Likely

What's new

  • 1. added coverage for Kafka (2.8.0 <= version < 4.2.2) +1 products Oct 28, 18:22 via oss-security
  • 2. added coverage for Kafka (3.7.0-4.1.2) +2 products Oct 28, 18:21 via oss-security

Apache Kafka is vulnerable to an information disclosure flaw (CVE-2026-112375) where an authenticated principal, even without 'ALTER_CONFIGS' permissions, can induce a broker to read arbitrary files and environment variables from the host filesystem. The vulnerability is triggered by sending a specially crafted 'IncrementalAlterConfigs' or 'AlterConfigs' request targeting a 'BROKER' resource.

Impact

Successful exploitation allows an authenticated principal to retrieve sensitive information from the broker host, including configuration files, credentials, or environment variables containing secrets.

Recommendation

  • Upgrade to a patched version of Apache Kafka once available.
  • Review Kafka ACLs to ensure minimal privilege for all principals and restrict access to the 'IncrementalAlterConfigs' and 'AlterConfigs' operations.
  • Monitor Kafka logs for unusual 'IncrementalAlterConfigs' or 'AlterConfigs' requests targeting 'BROKER' resources from unauthorized principals.

Immediate actions

Patch or upgrade Apache Kafka to the vendor-recommended secure version

IT Operations 72h

Threat Hunt

Search Kafka audit logs for AlterConfigs or IncrementalAlterConfigs requests directed at BROKER resources.

high high confidence hunt now

Data: Kafka Request Log / Audit Logs

Identify repeated broker crashes or OOM-Killer activity associated with Kafka process logs

T1499 medium medium confidence hunt now

Data: Broker logs, System dmesg/OOM-Killer logs, Kafka metrics

Investigate KRaft controller logs for unexpected process crashes or recurring crashes following FetchSnapshotRequest handling.

T1498 medium medium confidence monitor or close

Data: Kafka controller application logs, System daemon/service logs (e.g., systemd journal)

Mitigations

Review and audit Kafka ACLs to restrict ALTER_CONFIGS permissions to authorized principals only.

immediate IT Operations

CVE-2026-112375

Apply patch for CVE-2026-111073

immediate IT Operations

CVE-2026-111073

Upgrade Apache Kafka to 4.2.2 or 4.3.2

immediate IT Operations

CVE-2026-83525