{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kafka-connect--4.3.0--4.3.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-116593"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kafka Connect (\u003c 4.2.2)","Kafka Connect (\u003e= 4.3.0, \u003c 4.3.2)"],"_cs_severities":["medium"],"_cs_tags":["webserver","information-disclosure","cve-2026-116593"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Kafka Connect contains a flaw in the /connector-plugins/{connector-type}/config/validate REST API endpoint. This endpoint, intended for validating connector configurations, fails to properly protect sensitive configuration values handled by Configuration Providers. Consequently, an attacker with network access to the REST API can trigger the resolution of these secrets, causing them to be exposed in the validation response.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized disclosure of sensitive credentials or secrets stored within Configuration Providers, which were designed to remain masked until runtime.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Kafka Connect to version 4.2.2 or 4.3.2 to address CVE-2026-116593.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Kafka Connect REST API to authorized administrative IP addresses only.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for excessive or anomalous requests to the /connector-plugins/ path.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T18:21:14Z","date_published":"2026-10-28T18:21:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-connect-exposure/","summary":"A vulnerability in the Kafka Connect configuration validation REST API allows an attacker to exfiltrate sensitive secrets intended to be resolved only at runtime.","title":"Apache Kafka: Configuration provider values exposed in Kafka Connect validation endpoint (CVE-2026-116593)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-connect-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - Kafka Connect (\u003e= 4.3.0, \u003c 4.3.2)","version":"https://jsonfeed.org/version/1.1"}