Kafka Connect validate API exposes provider secrets (CVE-2026-116593)
Original title: CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
Builds before 4.2.2 and 4.3.2 can reveal configuration-provider values through the connector validation endpoint.
Apache rates CVE-2026-116593 moderate. Kafka Connect’s REST endpoint /connector-plugins/{connector-type}/config/validate checks connector configurations, while configuration providers are meant to hide sensitive values and resolve them only at runtime. The post says an attacker with access to that endpoint can reach those values, but the sentence is cut off. Affected releases are 2.4.0 before 4.2.2 and 4.3.0 before 4.3.2.
Unconfirmed: The description is cut off before fully stating the attacker’s required access.
- Apache lists the severity as moderate.
- Fixed lines implied by the ranges are 4.2.2 and 4.3.2.
- Configuration providers are intended to resolve secrets only at runtime.
- The snippet does not say the flaw is exploited.
Impact: Sensitive connector configuration values exposed
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software Foundation Apache Kafka Connect | 2.4.0 before 4.2.2; 4.3.0 before 4.3.2 | 4.2.2 and 4.3.2 |
- 1.Upgrade Kafka Connect to 4.2.2 or 4.3.2.
- CVEs
- CVE-2026-116593
- Vendors
- Apache Software Foundation
- Products
- Apache Kafka Connect
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116593 | Sensitive config leak via Kafka Connect validate API | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 2. 4. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.