Apache Kafka Connect CVE-2026-116593

Exploitation requires (1) network access to a Kafka Connect worker's REST API, specifically the /connector-plugins/{connector-type}/config/validate endpoint, and (2) at least one Configuration Provider installed and configured on that worker whose secret references the attacker can cause to be resolved. The Kafka Connect REST API has no authentication enabled by default, so in default deployments the endpoint is reachable without credentials. Limiting factors: deployments that place the REST API behind authentication, TLS client auth, or network segmentation reduce reachability, and the disclosure is bounded to secrets resolvable by the Configuration Providers actually configured on the worker. No fix exists other than upgrading to 4.2.2, 4.3.2, or 4.4.0 or above as stated by the vendor.

No CVSS vector, EPSS score, KEV listing, or PoC reference is supplied, so most quantitative exploitation signals are absent and cannot be contrasted. The one available priority signal is the vendor-sourced decision label 'this_month', indicating a moderate, non-emergency priority rather than urgent active-exploitation triage. Qualitatively the flaw is a serious information-disclosure issue: Apache Kafka Connect's REST validate endpoint can be abused to resolve and return in plaintext the very secrets that Configuration Providers are designed to keep hidden (database passwords, API keys, broker credentials). Real-world risk hinges on exposure of the Connect REST API - which ships without authentication by default - and on whether Configuration Providers are actually in use; where both hold, an attacker who can reach the endpoint can harvest high-value secrets with low effort. This is a genuine priority for exposed Connect clusters, but because the REST API is often network-restricted or authenticated in hardened deployments, blanket criticality should be tempered by actual exposure. Authentication requirements cannot be confirmed from the available data because no CVSS vector is provided.

An attacker who can reach a Kafka Connect worker's REST API sends a request to the /connector-plugins/{connector-type}/config/validate endpoint containing references that a configured Configuration Provider will resolve, causing the worker to return the resolved secret values in plaintext in the validation response. No public exploit code or PoC reference is identified in the provided data. Because the Connect REST API is unauthenticated by default, exploitation is straightforward wherever the endpoint is network-reachable and at least one Configuration Provider is installed.