Splunk Connect for Kafka CVE-2026-76402

Exploitation requires network reachability to the Kafka Connect REST API; no authentication to that API is required, confirmed by CVSS PR:N. The vulnerability is specifically triggered by the absence of mandatory HTTPS enforcement on HEC endpoint configuration - any connector deployment where the REST API is accessible over the network and HEC endpoint validation permits non-TLS URLs is at risk. Exploitation is constrained by the following factors: (1) the Kafka Connect REST API must be network-reachable by the attacker - deployments where the API is bound to localhost, placed behind an authenticating reverse proxy, or restricted by firewall policy are not directly exploitable via this vector; (2) only Splunk Connect for Kafka versions in the 2.2 branch below 2.2.7 are confirmed affected per available advisory data; (3) the impact on Splunk Enterprise (credential exposure and event-delivery alteration) is a secondary consequence of connector misconfiguration, not a direct exploit of the Splunk Enterprise platform itself.

The vendor-supplied CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) accurately captures the unauthenticated, low-friction attack path and high confidentiality impact from credential theft, though the S:U rating may understate the secondary blast radius since stolen HEC tokens provide write access to a distinct system - Splunk Enterprise. EPSS score data was not included in the input, so exploitation probability cannot be numerically quantified. No CISA KEV listing is present and no public exploit code has been identified, indicating opportunistic at-scale exploitation has not been observed, but the attack is mechanically simple enough that even a mid-sized municipal IT team in inowroclaw running this connector stack with an exposed REST API should treat this as a high-priority remediation. The greatest real-world risk compounds beyond the base vector: HEC token compromise enables an attacker to inject fabricated events into Splunk, potentially poisoning SIEM detection data and undermining incident response integrity. Risk is substantially reduced if the Kafka Connect REST API is restricted to trusted management hosts or bound only to localhost.

An attacker with network-level access to the Kafka Connect REST API sends a simple unauthenticated HTTP PUT or POST request reconfiguring the HEC sink connector's target URL to an HTTP server they control. The connector immediately begins forwarding all Kafka topic records and the embedded HEC authentication token in cleartext to the attacker's endpoint, granting persistent credential access and a full copy of the data pipeline until the misconfiguration is discovered and corrected.