CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11671

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

CVE-2026-112375 affects Apache Kafka versions 3.2.0 through 4.3.1 and allows an authenticated principal without authorization grants to make a broker read arbitrary files or environment variables on the broker host. The vulnerability is triggered through IncrementalAlterConfigs or AlterConfigs requests targeting broker resources.

Why it matters: Organizations running affected Kafka versions must patch immediately, as any authenticated user can exfiltrate sensitive configuration data and credentials from broker systems regardless of their granted permissions.

CVEsCVE-2026-112375
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary