{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapachekafka4.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka:3.7.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka:4.1.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:kafka:4.3.0:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-112375"},{"id":"CVE-2026-111073"},{"id":"CVE-2026-83525"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kafka (3.2.0-4.1.2)","Kafka (4.2.0-4.2.1)","Kafka (4.3.0-4.3.1)","Kafka (3.7.0-4.1.2)","Kafka (4.3.0)","Kafka (2.8.0 \u003c= version \u003c 4.2.2)","Kafka (4.3.0 \u003c= version \u003c 4.3.2)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","vulnerability","backend","cve-2026-83525"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Kafka is vulnerable to an information disclosure flaw (CVE-2026-112375) where an authenticated principal, even without 'ALTER_CONFIGS' permissions, can induce a broker to read arbitrary files and environment variables from the host filesystem. The vulnerability is triggered by sending a specially crafted 'IncrementalAlterConfigs' or 'AlterConfigs' request targeting a 'BROKER' resource.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated principal to retrieve sensitive information from the broker host, including configuration files, credentials, or environment variables containing secrets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of Apache Kafka once available.\u003c/li\u003e\n\u003cli\u003eReview Kafka ACLs to ensure minimal privilege for all principals and restrict access to the 'IncrementalAlterConfigs' and 'AlterConfigs' operations.\u003c/li\u003e\n\u003cli\u003eMonitor Kafka logs for unusual 'IncrementalAlterConfigs' or 'AlterConfigs' requests targeting 'BROKER' resources from unauthorized principals.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T18:22:08Z","date_published":"2026-10-28T18:21:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-arbitrary-read/","summary":"An authenticated principal in Apache Kafka can leverage crafted IncrementalAlterConfigs or AlterConfigs requests to perform arbitrary file and environment variable reads from the broker host.","title":"Apache Kafka: Unauthorized arbitrary file and environment variable read (CVE-2026-112375)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-arbitrary-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:kafka:4.3.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}