Sensitive Configuration Exposure in Apache Kafka Connect

CVE-2026-116593

What is CVE-2026-116593?

Apache Kafka Connect features an endpoint within its REST API that validates connector configurations using the /connector-plugins/{connector-type}/config/validate route. This functionality, when improperly accessed, allows an attacker to retrieve sensitive configuration data in plaintext from any installed Configuration Provider. Such exposure poses significant risks to user data security, emphasizing the need for appropriate access controls. Users should ensure they upgrade to versions 4.2.2, 4.3.2, or 4.4.0 and above to mitigate this vulnerability.

References