TI-2025-21950 Aliases CVE-2025-30677 GHSA-rcqj-3fmp-5cqx

Sensitive information in log files in Apache Pulsar IO Kafka Connector

LOW 29CWE-532Published 2025-04-09 · Updated 2025-04-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue. This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4. 3.0.x version users should upgrade to at least 3.0.11. 3.3.x version users should upgrade to at least 3.3.6. 4.0.x version users should upgrade to at least 4.0.4. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00745 55th percentileScored 2026-11-07

Fix Fixed Apache Pulsar IO Kafka Connector (Apache Software Foundation): 3.0.11, 3.3.6, 4.0.4Apache Pulsar IO Kafka Connect Adaptor (Apache Software Foundation): 3.0.11, 3.3.6, 4.0.4+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Pulsar IO Kafka Connector	2.3.0 to before 3.0.11; 3.1.0 to before 3.3.6; 4.0.0 to before 4.0.4	3.0.11, 3.3.6, 4.0.4	Patch available	CNA
Apache	Apache Pulsar IO Kafka Connect Adaptor	2.3.0 to before 3.0.11; 3.1.0 to before 3.3.6; 4.0.0 to before 4.0.4	3.0.11, 3.3.6, 4.0.4	Patch available	CNA
—	org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven)	before 3.0.11	3.0.11	Patch available	GHSA-rcqj-3fmp-5cqx
—	org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven)	3.3.0 to before 3.3.6	3.3.6	Patch available	GHSA-rcqj-3fmp-5cqx
—	org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven)	4.0.0 to before 4.0.4	4.0.4	Patch available	GHSA-rcqj-3fmp-5cqx
—	org.apache.pulsar:pulsar-io-kafka (Maven)	before 3.0.11	3.0.11	Patch available	GHSA-rcqj-3fmp-5cqx
—	org.apache.pulsar:pulsar-io-kafka (Maven)	3.3.0 to before 3.3.6	3.3.6	Patch available	GHSA-rcqj-3fmp-5cqx
—	org.apache.pulsar:pulsar-io-kafka (Maven)	4.0.0 to before 4.0.4	4.0.4	Patch available	GHSA-rcqj-3fmp-5cqx

Apache Pulsar IO Kafka Connector VendorApache Affected 2.3.0 to before 3.0.11; 3.1.0 to before 3.3.6; 4.0.0 to before 4.0.4 Fixed in 3.0.11, 3.3.6, 4.0.4 Patch available CNA
Apache Pulsar IO Kafka Connect Adaptor VendorApache Affected 2.3.0 to before 3.0.11; 3.1.0 to before 3.3.6; 4.0.0 to before 4.0.4 Fixed in 3.0.11, 3.3.6, 4.0.4 Patch available CNA
org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven) Vendor— Affected before 3.0.11 Fixed in 3.0.11 Patch available GHSA-rcqj-3fmp-5cqx
org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven) Vendor— Affected 3.3.0 to before 3.3.6 Fixed in 3.3.6 Patch available GHSA-rcqj-3fmp-5cqx
org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven) Vendor— Affected 4.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-rcqj-3fmp-5cqx
org.apache.pulsar:pulsar-io-kafka (Maven) Vendor— Affected before 3.0.11 Fixed in 3.0.11 Patch available GHSA-rcqj-3fmp-5cqx
org.apache.pulsar:pulsar-io-kafka (Maven) Vendor— Affected 3.3.0 to before 3.3.6 Fixed in 3.3.6 Patch available GHSA-rcqj-3fmp-5cqx
org.apache.pulsar:pulsar-io-kafka (Maven) Vendor— Affected 4.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-rcqj-3fmp-5cqx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:pulsar::::::::	2.3.0 to before 3.0.11; 3.3.0 to before 3.3.6; 4.0.0 to before 4.0.4	Vulnerable	Apache

cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.3.0 to before 3.0.11; 3.3.0 to before 3.3.6; 4.0.0 to before 4.0.4 Vulnerable ·Apache

Remediation

Fix · CNA Apache Pulsar IO Kafka Connector (Apache Software Foundation) Fixed in 3.0.11, 3.3.6, 4.0.4
Fix · CNA Apache Pulsar IO Kafka Connect Adaptor (Apache Software Foundation) Fixed in 3.0.11, 3.3.6, 4.0.4
Fix · GHSA-rcqj-3fmp-5cqx org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven) Fixed in 3.0.11 Advisory →
Fix · GHSA-rcqj-3fmp-5cqx org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven) Fixed in 3.3.6 Advisory →
Fix · GHSA-rcqj-3fmp-5cqx org.apache.pulsar:pulsar-io-kafka-connect-adaptor (Maven) Fixed in 4.0.4 Advisory →
Fix · GHSA-rcqj-3fmp-5cqx org.apache.pulsar:pulsar-io-kafka (Maven) Fixed in 3.0.11 Advisory →
Fix · GHSA-rcqj-3fmp-5cqx org.apache.pulsar:pulsar-io-kafka (Maven) Fixed in 3.3.6 Advisory →
Fix · GHSA-rcqj-3fmp-5cqx org.apache.pulsar:pulsar-io-kafka (Maven) Fixed in 4.0.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-30677
2026-10-03 Alias added: GHSA-rcqj-3fmp-5cqx

References

Advisory 4

Other 3

TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences