EUVD-2026-62968
GHSA-xf48-ph6x-76rj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network vector and PR:N are correct as attacker is passive MitM; AC:H reflects mandatory network-path positioning; no availability impact applies.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate validation options when it builds the HTTP client. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Security configurations for Splunk Connect for Kafka (https://help.splunk.com/en/splunk-enterprise/get-data-in/splunk-connect-for-kafka/2.2/configure/security-configurations-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.
AnalysisAI
Certificate validation bypass in Splunk Connect for Kafka below version 2.2.7 allows a network-positioned unauthenticated attacker to intercept and modify event data in transit to Splunk Enterprise's HTTP Event Collector when Kerberos authentication is configured. The Kerberos code path fails to apply the connector's configured TLS certificate validation options when constructing the HTTP client, effectively negating transport security despite HEC's TLS configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific preconditions: (1) Kerberos authentication must be the configured authentication method for the connector's HEC connection - deployments using token-based or other HEC authentication methods are not affected by this code path defect; (2) the attacker must achieve a network man-in-the-middle position between the Kafka connector and the Splunk HEC endpoint, which requires either compromised network infrastructure, Layer 2 access to the same network segment, or the ability to manipulate routing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects an accurate picture: network attack vector is correct since the connector communicates with HEC over a network path, but AC:H appropriately captures the requirement that the attacker must be physically or logically interposed in the network path (e.g., via ARP spoofing, rogue routing, or compromised network infrastructure). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to a network segment between the Kafka connector host and the Splunk HEC endpoint performs ARP poisoning or BGP route injection to redirect connector-to-HEC traffic through an attacker-controlled proxy. Because the Kerberos code path skips certificate validation, the connector accepts the attacker's self-signed or forged certificate, allowing full decryption of the TLS stream. … |
| Remediation | Upgrade Splunk Connect for Kafka to version 2.2.7 or later, which is the vendor-confirmed patched release per EUVD-2026-62968 and the Splunk advisory at https://advisory.splunk.com/advisories/SVD-2026-0808. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Splunk Connect for Kafka versions below 2.2.7 and document which deployments use Kerberos authentication with HTTP Event Collector, as these are directly vulnerable to the certificate validation bypass. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today