Kafka Connect admin REST API auth bypass (CVE-2026-115644)
Original title: CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
A separate admin.listeners setup can leave configured REST extensions unapplied, bypassing admin API authentication.
Apache rates CVE-2026-115644 low. Kafka Connect can bypass authentication on the admin REST API when admin.listeners uses a listener separate from the main listeners property. Operators who isolate the admin API with admin.listeners may not have REST extensions applied as configured. Affected versions are 2.4.0 before 4.2.2 and 4.3.0 before 4.3.2. The description is truncated.
Unconfirmed: The post is cut off before explaining which REST extensions fail to apply.
- The issue applies when admin.listeners is set separately from listeners.
- Apache lists severity as low.
- The same before-4.2.2 and before-4.3.2 ranges are affected.
- No exploitation is stated.
Impact: Authentication bypass on the Connect admin REST API
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software Foundation Apache Kafka Connect | 2.4.0 before 4.2.2; 4.3.0 before 4.3.2 | 4.2.2 and 4.3.2 |
- 1.Upgrade Kafka Connect to 4.2.2 or 4.3.2.
- CVEs
- CVE-2026-115644
- Vendors
- Apache Software Foundation
- Products
- Apache Kafka Connect
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115644 | Auth bypass in Kafka Connect admin REST with split admin.listeners | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: low Affected versions: - Apache Kafka 2. 4. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.