Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Apache Kafka 4.2.2, 4.3.2 Clear all filters
TI-2026-82055 CVE-2026-116593 · GHSA-mf84-q3cw-6ch9

Kafka Connect validate endpoint exposes resolved configuration values

Priority LOW 38

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00472 Published 2026-10-28 Fixed in 4.2.2, 4.3.2 CWE-200
TI-2026-82054 CVE-2026-115644 · GHSA-jmxh-862m-3gxj

Authentication bypass in Apache Kafka Connect admin REST API

Priority MEDIUM 41

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00524 Published 2026-10-28 Partial fix · 4.2.2, 4.3.2 CWE-288
TI-2026-82021 CVE-2026-83525 · GHSA-34hc-fwhq-c7v8

Incorrect operator in Kafka FetchSnapshot enables controller crash

Priority LOW 29

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0033 Published 2026-10-28 Fixed in 4.2.2, 4.3.2 CWE-480