As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
CVE-2026-116593 affects Apache Kafka Connect versions 2.4.0 through 4.2.2 and 4.3.0 through 4.3.2, where the /connector-plugins/{connector-type}/config/validate endpoint on the REST application programming interface (API) exposes sensitive configuration provider values that should remain hidden at runtime. An attacker with access to the validation API can extract these secrets.
Why it matters: Operators running affected Kafka Connect deployments are exposed to credential theft if an attacker reaches the validation endpoint; upgrading to patched versions or restricting API access is required to prevent secret leakage.
- Source published
- First seen by Cybersecurity Tracker