{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/splunk-connect-for-kafka--2.2.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-76402"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Splunk Connect for Kafka (\u003c 2.2.7)"],"_cs_severities":["high"],"_cs_tags":["credential-exposure","api-vulnerability","splunk"],"_cs_type":"advisory","_cs_vendors":["Splunk"],"content_html":"\u003cp\u003eSplunk Connect for Kafka versions below 2.2.7 contain a vulnerability (CVE-2026-76402) that permits an unauthenticated user with network access to the Kafka Connect REST API to perform unauthorized configuration changes. The flaw stems from insufficient validation of HTTP Event Collector (HEC) endpoints, specifically the lack of mandatory secure transport (HTTPS) for these connections. By reconfiguring the HEC endpoint to an attacker-controlled server, the connector can be coerced into transmitting sensitive authentication credentials and data streams to an external, unauthorized host. This exposure compromises the confidentiality of data passing through the connector and allows for the modification of event delivery paths. Defenders should prioritize updating affected Splunk Connect for Kafka deployments to version 2.2.7 or later to enforce secure HEC configuration.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to the exposure of HEC authentication credentials and the interception or manipulation of sensitive data streams within the Kafka to Splunk ingestion pipeline. This results in significant risks to data integrity and unauthorized access to downstream Splunk Enterprise environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Splunk Connect for Kafka to version 2.2.7 or higher immediately to address CVE-2026-76402.\u003c/li\u003e\n\u003cli\u003eAudit existing Kafka Connect REST API configurations for non-standard or unauthorized HEC endpoint URLs that utilize HTTP instead of HTTPS.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Kafka Connect REST API to authorized management IP addresses only, preventing unauthenticated reachability from the broader network.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:45:04Z","date_published":"2026-08-19T22:45:04Z","id":"https://feed.craftedsignal.io/briefs/2026-08-splunk-kafka-hec/","summary":"Splunk Connect for Kafka versions below 2.2.7 are vulnerable to credential theft through an unauthenticated REST API endpoint, allowing attackers to redirect HEC traffic to malicious servers.","title":"Credential Exposure in Splunk Connect for Kafka via HEC Configuration","url":"https://feed.craftedsignal.io/briefs/2026-08-splunk-kafka-hec/"}],"language":"en","title":"CraftedSignal Threat Feed - Splunk Connect for Kafka (\u003c 2.2.7)","version":"https://jsonfeed.org/version/1.1"}