Sensitive Configuration Exposure in Apache Pulsar's Integration with Apache Kafka

CVE-2025-30677

Summary

Apache Pulsar IO's integration with Apache Kafka contains a vulnerability where sensitive configuration properties are logged in plain text in application logs. This can lead to potential credential leakage, especially for Apache Kafka. Attackers with access to these logs could exploit this issue to acquire sensitive credentials. It is essential for users of Apache Pulsar to upgrade to the patched versions (3.0.11, 3.3.6, and 4.0.4 or newer) to protect against this vulnerability. Failure to do so increases the risk of unauthorized access and data breaches.

References