Apache Kafka: Configuration provider values exposed in Kafka Connect validation endpoint (CVE-2026-116593)
A vulnerability in the Kafka Connect configuration validation REST API allows an attacker to exfiltrate sensitive secrets intended to be resolved only at runtime.
CVE search metadata
CVE search record: CVE-2026-116593. KEV: no. Product: Kafka Connect (< 4.2.2), Kafka Connect (>= 4.3.0, < 4.3.2). Brief: Apache Kafka: Configuration provider values exposed in Kafka Connect validation endpoint (CVE-2026-116593). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-connect-exposure/
Triage facts
Revision 1- Applicability
- Kafka Connect (< 4.2.2), Kafka Connect (>= 4.3.0, < 4.3.2)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 18:21 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Apache Kafka Connect contains a flaw in the /connector-plugins/{connector-type}/config/validate REST API endpoint. This endpoint, intended for validating connector configurations, fails to properly protect sensitive configuration values handled by Configuration Providers. Consequently, an attacker with network access to the REST API can trigger the resolution of these secrets, causing them to be exposed in the validation response.
Impact
Successful exploitation allows unauthorized disclosure of sensitive credentials or secrets stored within Configuration Providers, which were designed to remain masked until runtime.
Recommendation
- Upgrade Apache Kafka Connect to version 4.2.2 or 4.3.2 to address CVE-2026-116593.
- Restrict network access to the Kafka Connect REST API to authorized administrative IP addresses only.
- Implement monitoring for excessive or anomalous requests to the /connector-plugins/ path.
Immediate actions
Patch Apache Kafka Connect to 4.2.2 or 4.3.2
Threat Hunt
Monitor for POST requests to /connector-plugins/*/config/validate
Data: Web server access logs
Mitigations
Implement network segmentation or API gateway filtering to restrict access to the Kafka Connect REST API
CVE-2026-116593