File and Environment Variable Disclosure in Apache Kafka
CVE-2026-112375

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Kafka
Vendor
CVE Published:
28 October 2026

What is CVE-2026-112375?

An authenticated Kafka principal can exploit a vulnerability to read files and environment variables from the broker host without proper authorization. This occurs when an IncrementalAlterConfigs or AlterConfigs request is made, allowing configuration validation to bypass essential authorization checks, exposing sensitive information like credentials and keystores. To mitigate this risk, it is crucial to upgrade to Apache Kafka versions 4.2.2, 4.3.2, or 4.4.0 and implement least-privilege practices for broker operating-system accounts.

Affected Version(s)

Apache Kafka 3.2.0 <= 4.1.2

Apache Kafka 4.2.0 <= 4.2.1

Apache Kafka 4.3.0 <= 4.3.1

References

https://kafka.apache.org/cve-list
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arthur Chan <arthur.chan@adalogics.com>, Ada Logics and Anthropic Research
OpenAI Codex Security - Amy Burnett and Khai Tran
Mickael Maison <mickael.maison@gmail.com>
Manikumar Reddy <manikumar.reddy@gmail.com>
Chia-Ping Tsai <chia7712@gmail.com>
.