Apache Kafka Connect CVE-2026-115644

Exploitation requires two specific non-default conditions stated by the vendor: (1) the admin REST API must be isolated via an explicitly set admin.listeners property pointing to a separate listener from the main listeners property, and (2) security must be enforced through REST extensions in rest.extension.classes (e.g. BasicAuthSecurityRestExtension) - the bypass is that these extensions silently fail to register on the admin listener. The attacker additionally needs network access to that admin listener. Deployments that leave admin.listeners unset (the default, where admin resources share the regular listener) are not affected, which is also the vendor's recommended mitigation. Impact is limited to the /admin/loggers endpoint: information disclosure of logger/class names and read/write of log levels (including cluster-wide propagation), affecting observability and availability rather than data or code integrity.

No CVSS score or vector is provided in the input, so attack metrics must be inferred from the vendor description rather than confirmed. The vuln.today Decision label is 'monitor' (the lowest urgency tier here), there is no CISA KEV listing, no EPSS score is supplied, and no public exploit or PoC is referenced - so all available decision signals point to low real-world urgency rather than an emergency. The underlying flaw is a genuine authentication bypass (REST security extensions from rest.extension.classes are not applied to the separate admin listener), but it is strongly gated: it only manifests when operators explicitly configure admin.listeners as a separate listener AND rely on rest.extension.classes (e.g. BasicAuthSecurityRestExtension) for security - a non-default, opt-in hardening configuration. The exposed capability is also narrow: read/write of the /admin/loggers endpoint, which discloses loaded class names and lets an attacker change log levels (including cluster-wide via scope=cluster), affecting observability and potentially availability through log suppression or log flooding - not code execution, data exfiltration of Kafka records, or cluster takeover. Net assessment: a real, vendor-confirmed bypass that is low-to-moderate priority - the broad deployment of Kafka is offset by the narrow impact, the non-default triggering configuration, and the absence of any exploitation signal. Teams running the specific admin.listeners configuration should prioritize it above those who are not, who are unaffected.

An operator has hardened a Kafka Connect cluster by isolating the admin REST API on a separate listener via admin.listeners and enabling BasicAuthSecurityRestExtension on the main listener; an attacker with network reachability to that admin listener sends unauthenticated requests to /admin/loggers, reads logger names to fingerprint loaded classes and active security extensions, then issues a write with scope=cluster to set the root logger to OFF (suppressing security logging) or TRACE (flooding logs) across all workers. No public exploit or PoC is identified at time of analysis; the attack is simple HTTP requests requiring no authentication once the admin listener is network-reachable.