Kafka lets unauthorized principals read broker files (CVE-2026-112375)
Original title: CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
An authenticated principal with no grants can make a broker return a host file or environment variable.
Apache rates CVE-2026-112375 important. An authenticated Kafka principal that has no authorization grants, including no ALTER_CONFIGS, can make a broker read a file or an environment variable on the broker host and return its contents. The request is an IncrementalAlterConfigs or AlterConfigs call targeting a BROKER resource. The description stops there, and no fix is named.
Unconfirmed: How far the file read reaches is unstated because the description is cut off, and no fix is given.
- The caller needs authentication but no authorization grants.
- Affected builds are 3.2.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1.
- Both IncrementalAlterConfigs and AlterConfigs are named.
- The snippet does not state exploitation or a fixed version.
Impact: Authenticated principal reads broker files or environment variables
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Kafka | 3.2.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1 |
- CVEs
- CVE-2026-112375
- Vendors
- Apache Software Foundation
- Products
- Apache Kafka
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112375 | Unauthorized file and env read in Apache Kafka config change | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 3. 2. 0 through 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.