Cve-2026-116593 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-116593/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 18:21:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Kafka: Configuration provider values exposed in Kafka Connect validation endpoint (CVE-2026-116593)https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-connect-exposure/Wed, 28 Oct 2026 18:21:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-kafka-connect-exposure/A vulnerability in the Kafka Connect configuration validation REST API allows an attacker to exfiltrate sensitive secrets intended to be resolved only at runtime.Apache Kafka Connect contains a flaw in the /connector-plugins/{connector-type}/config/validate REST API endpoint. This endpoint, intended for validating connector configurations, fails to properly protect sensitive configuration values handled by Configuration Providers. Consequently, an attacker with network access to the REST API can trigger the resolution of these secrets, causing them to be exposed in the validation response.

Impact

Successful exploitation allows unauthorized disclosure of sensitive credentials or secrets stored within Configuration Providers, which were designed to remain masked until runtime.

Recommendation

  • Upgrade Apache Kafka Connect to version 4.2.2 or 4.3.2 to address CVE-2026-116593.
  • Restrict network access to the Kafka Connect REST API to authorized administrative IP addresses only.
  • Implement monitoring for excessive or anomalous requests to the /connector-plugins/ path.
]]>mediumadvisorywebserverinformation-disclosurecve-2026-116593