Kafka (4.2.0-4.2.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kafka-4.2.0-4.2.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 18:21:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Kafka: Unauthorized arbitrary file and environment variable read (CVE-2026-112375)https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-arbitrary-read/Wed, 28 Oct 2026 18:21:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-kafka-arbitrary-read/An authenticated principal in Apache Kafka can leverage crafted IncrementalAlterConfigs or AlterConfigs requests to perform arbitrary file and environment variable reads from the broker host.Apache Kafka is vulnerable to an information disclosure flaw (CVE-2026-112375) where an authenticated principal, even without 'ALTER_CONFIGS' permissions, can induce a broker to read arbitrary files and environment variables from the host filesystem. The vulnerability is triggered by sending a specially crafted 'IncrementalAlterConfigs' or 'AlterConfigs' request targeting a 'BROKER' resource.

Impact

Successful exploitation allows an authenticated principal to retrieve sensitive information from the broker host, including configuration files, credentials, or environment variables containing secrets.

Recommendation

  • Upgrade to a patched version of Apache Kafka once available.
  • Review Kafka ACLs to ensure minimal privilege for all principals and restrict access to the 'IncrementalAlterConfigs' and 'AlterConfigs' operations.
  • Monitor Kafka logs for unusual 'IncrementalAlterConfigs' or 'AlterConfigs' requests targeting 'BROKER' resources from unauthorized principals.
]]>highadvisorydenial-of-servicevulnerabilitybackendcve-2026-83525