Kafka lets unauthorized principals read broker files (CVE-2026-112375)
An authenticated principal with no grants can make a broker return a host file or environment variable.
Stories per day · 30 days
Relateddenial-of-service7broker2information-disclosure2jwt2kafka-broker2kafka-connect2kafka-streams2oauth2rest-api2sasl2authentication1authentication-bypass1authorization1cwe-4801decompression1deserialization1iiot1integer-overflow1
4 stories, newest first · one card per story
Stories tagged #apache-kafka
Kafka Connect validate API exposes provider secrets (CVE-2026-116593)
Builds before 4.2.2 and 4.3.2 can reveal configuration-provider values through the connector validation endpoint.
Red Hat lists RHEL and Kafka products in advisory AV26-1084
The October 26 notice names affected lines but gives no CVE identifiers, impact, or fixed RHEL versions.
AIRO uses streaming ML to detect and mitigate IIoT threats
Authors report Gradient Boosting and LightGBM F1-scores up to 0.9229 on four noisy attack datasets with low mitigation latency.