Apache flags two Kafka Connect REST flaws before 4.2.2 and 4.3.2

1 source · 2 articlesFirst reported Oct 28, 2026 · 17:38 UTCUpdated Oct 28, 2026 · 17:40 UTC (2d ago)

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Kafka Connect before 4.2.2 and 4.3.2 has two REST API flaws, rated low and moderate, with no exploitation stated.

Apache published two Kafka Connect advisories on 28 October 2026. CVE-2026-115644, rated low, can bypass admin REST API authentication when admin.listeners is a listener separate from listeners, so configured REST extensions may not apply. CVE-2026-116593, rated moderate, can expose configuration-provider values through the connector validation endpoint; those providers are meant to resolve secrets only at runtime. Affected releases are 2.4.0 before 4.2.2 and 4.3.0 before 4.3.2. Neither oss-security post says the flaws are exploited, and both descriptions are truncated.

Key facts

CVE-2026-115644 is rated low by Apache.
Auth bypass applies when admin.listeners is set apart from listeners.
CVE-2026-116593 is rated moderate by Apache.
Validation endpoint can reveal configuration-provider values meant for runtime only.
Affected ranges are 2.4.0 before 4.2.2 and 4.3.0 before 4.3.2.
Neither post states that the flaws are exploited.

Analyze CVE-2026-116593 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 28, 2026oss-security posts both Kafka Connect advisories · oss-security

What each outlet adds

beyond the shared facts

oss-securityLow-severity admin REST auth bypass when admin.listeners is separate.
oss-securityModerate flaw can expose config-provider values via the validation endpoint.

CVEs: CVE-2026-116593 CVE-2026-115644

Vendors: Apache Software Foundation
Products: Apache Kafka Connect

Coverage

oldest first · one row per article · UTC

Oct 28, 17:38 UTC · 2d ago oss-securityFirst report
Kafka Connect admin REST API auth bypass (CVE-2026-115644)
A separate admin.listeners setup can leave configured REST extensions unapplied, bypassing admin API authentication.
Oct 28, 17:40 UTC · 2d ago oss-security
Kafka Connect validate API exposes provider secrets (CVE-2026-116593)
Builds before 4.2.2 and 4.3.2 can reveal configuration-provider values through the connector validation endpoint.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-115644 +1 related CVE CVE-2026-116593	Auth bypass in Kafka Connect admin REST with split admin.listeners	—	—		2d ago