CVE-2026-116593
Last modified
CVE-2026-116593 is a vulnerability of currently unknown severity. Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Kafka | >= 2.4.0, < 4.2.2; >= 4.3.0, < 4.3.2 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-116593?
How severe is CVE-2026-116593?
How do I fix CVE-2026-116593?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-116587Go JOSE provides an implementation of the Javascript Object …7.5
- CVE-2026-116588Datadog dd-trace-py is the Datadog Python APM client. From 1…8.7
- CVE-2026-116589Datadog dd-trace-py is the Datadog Python APM client. From 3…8.2
- CVE-2026-11659Integer overflow in UI in Google Chrome on Linux prior to 14…9.6
- CVE-2026-116590snappy-java is a Java port of the snappy, a fast C++ compres…5.9
- CVE-2026-116591compress provides various compression algorithms. Prior to 1…8.7
- CVE-2026-116596Pyrus Sync for Windows contains a local privilege escalation…
- CVE-2026-1166Open Redirect vulnerability in Hitachi Ops Center Administra…4.3
- CVE-2026-11660Insufficient validation of untrusted input in New Tab Page i…8.3
- CVE-2026-116602A vulnerability was detected in SourceCodester Online Food O…6.5
- CVE-2026-116603A flaw has been found in SourceCodester Online Food Ordering…4.7
- CVE-2026-116604A vulnerability has been found in SourceCodester Online Food…6.5
Are you affected by CVE-2026-116593?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST