CVE-2026-33558

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.

• CWE-533

• https://kafka.apache.org/cve-listVendor Advisory
• https://lists.apache.org/thread/pz5g4ky3h0k91tfd14p0dzqjp80960klMitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/04/17/3Mailing List

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33551An issue was discovered in OpenStack Keystone 14 through 26 …5.3
• CVE-2026-33552Northern.tech Mender Enterprise Server before 4.1.1 has Inco…3.7
• CVE-2026-33553Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3…6.1
• CVE-2026-33554ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer ov…7.5
• CVE-2026-33555An issue was discovered in HAProxy before 3.3.6. The HTTP/3 …5.8
• CVE-2026-33557A possible security vulnerability has been identified in Apa…9.1
• CVE-2026-33559WordPress Plugin "OpenStreetMap" provided by MiKa contains a…5.4
• CVE-2026-3356The MS27102A Remote Spectrum Monitor is vulnerable to an aut…9.3
• CVE-2026-33560The DMP-5000 file service exposes authenticated arbitrary fi…8.8
• CVE-2026-33565in OpenHarmony v6.0 and prior versions allow a local attacke…3.3
• CVE-2026-33566There is a cypher injection issue in LogonTracer prior to v2…5.1
• CVE-2026-33569Anviz CX2 Lite and CX7 administrative sessions occur over HT…6.5