CVE-2026-116593
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its…
- Risk score
- 51/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access …
- Affected
- See advisory
- Fix
- Upgrade the product to 4.2.2, 4.3.2 or 4.4.0 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.
Last activity 28 Oct 2026. Patch Forecast updates every hour.