Information Exposure Vulnerability in Apache Kafka
CVE-2026-33558

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Kafka
Apache Kafka Clients
Vendor
CVE Published:
20 April 2026

What is CVE-2026-33558?

An information exposure vulnerability has been discovered in Apache Kafka, where the NetworkClient component may log entire requests and responses at the DEBUG log level. If DEBUG logging is activated, it can inadvertently expose sensitive data from various API requests and responses including AlterConfigsRequest, AlterUserScramCredentialsRequest, and SaslAuthenticateResponse. This vulnerability impacts all supported versions up to v3.9.1 and v4.0.0. Users are strongly advised to upgrade to versions v3.9.2 or v4.0.1 and later to mitigate the risk.

Affected Version(s)

Apache Kafka 0.11.0 <= 3.9.1

Apache Kafka 4.0.0

Apache Kafka Clients 0.11.0 <= 3.9.1

References

https://kafka.apache.org/cve-list
vendor-advisory
https://lists.apache.org/thread/pz5g4ky3h0k91tfd14p0dzqjp...
mailing-list

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alyssa Huang <ahuang@confluent.io>
Luke Chen <showuon@gmail.com>
.