Apache Kafka: Admin REST API authentication bypass (CVE-2026-115644)
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.
CVE search metadata
CVE search record: CVE-2026-115644. KEV: no. Brief: Apache Kafka: Admin REST API authentication bypass (CVE-2026-115644). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-auth-bypass/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- Low
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 28, 19:24 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_vendors, claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API. This occurs when the admin.listeners property is configured with a separate listener from the main listeners property.