Read the docs
TI-2026-18953 Aliases CVE-2026-23529

Arbitrary File Read in Google BigQuery Sink connector

Priority LOW 34CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-73 and the CVSS impact.

Summary

Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file read in Google BigQuery Sink connector. Aiven's Google BigQuery Kafka Connect Sink connector requires Google Cloud credential configurations for authentication to BigQuery services. During connector configuration, users can supply credential JSON files that are processed by Google authentication libraries. The service fails to validate externally-sourced credential configurations before passing them to the authentication libraries. An attacker can exploit this by providing a malicious credential configuration containing crafted credential_source.file paths or credential_source.url endpoints, resulting in arbitrary file reads or SSRF attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00408 35th percentileScored 2026-11-07
Fix Fixed bigquery-connector-for-apache-kafka (Aiven-Open): 2.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aiven-Openbigquery-connector-for-apache-kafkabefore 2.11.02.11.0Patch availableCNA
  • bigquery-connector-for-apache-kafka VendorAiven-Open Affected before 2.11.0 Fixed in 2.11.0 Patch available CNA

Remediation

  • Fix · CNA bigquery-connector-for-apache-kafka (Aiven-Open) Fixed in 2.11.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23529

References

Other 4

  • TI-2025-38105 Karapace is vulnerable to Authentication Bypass CVSS 3.1HIGH 8.6
  • TI-2025-34940 aiven-db-migrate allows Privilege Escalation through use of psql during migration CVSS 3.1CRITICAL 9.1
  • TI-2025-22661 aiven-extras allows PostgreSQL Privilege Escalation through format function CVSS 3.1CRITICAL 9.1
  • TI-2025-34939 aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration CVSS 3.1CRITICAL 9.1
  • TI-2026-79625 Path traversal in PGHoard restore allows arbitrary file writes CVSS 3.1HIGH 8.4
  • TI-2023-15599 aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path CVSS 3.1HIGH 8.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences