Cleartext transmission of sensitive information in Apache Kafka
Priority LOW 39CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-319.
Summary
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
Why it matters now
EPSS 0.03915 90th percentileScored 2026-11-07
Fix Fixed org.apache.kafka:kafka (Maven): 2.0.2, 2.1.2, 2.2.2 +1Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Kafka | Apache Kafka 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.2.0; 2.2.1; 2.3.0 | — | No fix listed | CNA |
| — | org.apache.kafka:kafka (Maven) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-6jmf-mxwf-r3jc |
| — | org.apache.kafka:kafka (Maven) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-6jmf-mxwf-r3jc |
| — | org.apache.kafka:kafka (Maven) | 2.2.0 to before 2.2.2 | 2.2.2 | Patch available | GHSA-6jmf-mxwf-r3jc |
| — | org.apache.kafka:kafka (Maven) | 2.3.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-6jmf-mxwf-r3jc |
- Kafka VendorApache Affected Apache Kafka 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.2.0; 2.2.1; 2.3.0 Fixed in — No fix listed CNA
- org.apache.kafka:kafka (Maven) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-6jmf-mxwf-r3jc
- org.apache.kafka:kafka (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-6jmf-mxwf-r3jc
- org.apache.kafka:kafka (Maven) Vendor— Affected 2.2.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-6jmf-mxwf-r3jc
- org.apache.kafka:kafka (Maven) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-6jmf-mxwf-r3jc
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:kafka:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kafka:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:kafka:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kafka:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:kafka:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kafka:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:kafka:2.3.0:*:*:*:*:*:*:* | 2.3.0 | Vulnerable | Apache |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.1.0:*:*:*:*:*:*:* | 14.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.4.0:*:*:*:*:*:*:* | 14.4.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:kafka:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kafka:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:kafka:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kafka:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache
- cpe:2.3:a:apache:kafka:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kafka:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Apache
- cpe:2.3:a:apache:kafka:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Apache
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.4.0:*:*:*:*:*:*:* Versions 14.4.0 Vulnerable ·Oracle
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.1.0:*:*:*:*:*:*:* | 14.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.4.0:*:*:*:*:*:*:* | 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_liquidity_management:*:*:*:*:*:*:*:* | 14.0.0 – 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_payments:14.4.0:*:*:*:*:*:*:* | 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:*:*:*:*:*:*:*:* | 14.2.0 – 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.1.0:*:*:*:*:*:*:* | 14.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.4.0:*:*:*:*:*:*:* | 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.1.0:*:*:*:*:*:*:* | 14.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.4.0:*:*:*:*:*:*:* | 14.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* | before 21.1.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_universal_banking:14.4.0:*:*:*:*:*:*:* | 14.4.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.4.0:*:*:*:*:*:*:* Versions 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_liquidity_management:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_payments:14.4.0:*:*:*:*:*:*:* Versions 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:*:*:*:*:*:*:*:* Versions 14.2.0 – 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.4.0:*:*:*:*:*:*:* Versions 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.4.0:*:*:*:*:*:*:* Versions 14.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_universal_banking:14.4.0:*:*:*:*:*:*:* Versions 14.4.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-6jmf-mxwf-r3jc org.apache.kafka:kafka (Maven) Fixed in 2.0.2 Advisory →
- Fix · GHSA-6jmf-mxwf-r3jc org.apache.kafka:kafka (Maven) Fixed in 2.1.2 Advisory →
- Fix · GHSA-6jmf-mxwf-r3jc org.apache.kafka:kafka (Maven) Fixed in 2.2.2 Advisory →
- Fix · GHSA-6jmf-mxwf-r3jc org.apache.kafka:kafka (Maven) Fixed in 2.3.1 Advisory →
Red Hat 1 advisory
- RHSA-2020:0939 Released 2020-03-23 · Red Hat rating ImportantRed Hat AMQ Streams 1.4.0 release and security update
- Red Hat AMQ Streams 1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Streams 1 | Fixed | RHSA-2020:0939 |
Not affected: 5 products
- Red Hat Decision Manager 7
- Red Hat Fuse 7
- Red Hat JBoss Fuse 6
- Red Hat OpenShift Application Runtimes
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12399
- 2026-10-03 Alias added: GHSA-6jmf-mxwf-r3jc
- 2026-10-06 EPSS moved to the 90th–95th percentile
References
Patch 4
Advisory 3
Other 36
- [kafka-users] 20200113 CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint
- [announce] 20200113 CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint
- [kafka-commits] 20200115 [kafka-site] branch asf-site updated: Add CVE-2019-12399 (#250)
- [druid-commits] 20200126 [GitHub] [druid] clintropolis opened a new pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200126 [GitHub] [druid] suneet-s commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200126 [GitHub] [druid] clintropolis commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200126 [GitHub] [druid] clintropolis commented on issue #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] ccaominh opened a new pull request #9261: Address CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] suneet-s commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] ccaominh commented on issue #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] clintropolis commented on a change in pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] clintropolis commented on issue #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] clintropolis commented on a change in pull request #9261: Address CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] ccaominh closed pull request #9261: Address CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] ccaominh commented on issue #9261: Address CVE-2019-12399
- [druid-commits] 20200127 [GitHub] [druid] jihoonson merged pull request #9259: fix build by updating kafka client to 2.2.2 for CVE-2019-12399
- [druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization
- [kafka-commits] 20210921 [kafka-site] branch asf-site updated: Add CVE-2021-38153 (#375)
- https://lists.apache.org/thread.html/rfe90ca0463c199b99c2921410639aed53a172ea8b733eab0dc776262@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rde947ee866de6687bc51cdc8dfa6d7e6b3ad4ce8c708c344f773e6dc@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rda253155601968331b5cf0da4f273813bbd91843c2568a8495d1c662@%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rc27d424d0bdeaf31081c3e246db3c66e882243ae3f342dfa845e0261@%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r9871a4215b621c1d09deee5eba97f0f44fde01b4363deb1bed0dd160@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r801c68bf987931f35d2e24ecc99f3aa2850fdd8f5ef15fe6c60fecf3@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r6fa1cff4786dcef2ddd1d717836ef123c878e8321c24855bad24ae0f@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9@%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r6af5ed95726874e9add022955be83c192428c248d1c9a1914aff89d9@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r56eb055b544931451283fee51f7e1f5b8ebd3085fed7d77aaba504c9@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r4d9e87cdae99e98d7b244cfa53d9d2532d368d3a187fbc87c493dcbe@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r4b20b40c40d4a4c641e2ef4228098a57935e5782bfdfdf3650e48265@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r47c225db363d1ee2c18c4b3b2f51b63a9789f78c7fa602e5976ecd05@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r3203d7f25a6ca56ff3e48c43a6aa7cb60b8e5d57d0eed9f76dc2b7a8@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r3154f5adbc905f1f9012a92240c8e00a96628470cc819453b9606d0e@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r2d390dec5f360ec8aa294bef18e1a4385e2a3698d747209216f5a48b@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r0e3a613705d70950aca2bfe9a6265c87503921852d9a3dbce512ca9f@%3Ccommits.druid.apache.org%3E
More Apache Kafka vulnerabilities
- TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
- TI-2026-25947 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication CVSS 3.1CRITICAL 9.1
- TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
- TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
- TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
- TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5
Sources
- CVE-2019-12399 · CVE Program
- CVE-2019-12399 · NVD
- FIRST EPSS
- GHSA-6jmf-mxwf-r3jc · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12399 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences