Splunk Connect For Kafka
Monthly
Certificate validation bypass in Splunk Connect for Kafka below version 2.2.7 allows a network-positioned unauthenticated attacker to intercept and modify event data in transit to Splunk Enterprise's HTTP Event Collector when Kerberos authentication is configured. The Kerberos code path fails to apply the connector's configured TLS certificate validation options when constructing the HTTP client, effectively negating transport security despite HEC's TLS configuration. No active exploitation has been identified (not in CISA KEV), but the confidentiality and integrity impact on Splunk-ingested telemetry data is high.
Unauthenticated access to the Kafka Connect REST API in Splunk Connect for Kafka versions below 2.2.7 enables an SSRF-class attack that reconfigures the HTTP Event Collector destination to an attacker-controlled endpoint, resulting in theft of HEC authentication credentials and partial manipulation of event delivery to Splunk Enterprise. The connector's HEC endpoint validation does not enforce secure transport by default, meaning a non-TLS HTTP destination can be substituted without any authentication. No public exploit has been identified at time of analysis, but the attack requires no privileges and trivially low complexity, making any deployment with a network-exposed Kafka Connect REST API immediately actionable.
Unauthenticated ReDoS in Splunk Connect for Kafka below version 2.2.7 allows a network-accessible attacker to permanently block a Kafka Connect worker thread by submitting a pathological regular expression via the Kafka Connect REST API, which - when triggered by attacker-supplied or coincident matching event data during timestamp extraction - causes the regex engine to backtrack catastrophically without bound. The practical result is complete stoppage of event delivery for the targeted connector, constituting a targeted denial-of-service against Splunk data ingestion pipelines. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS AC:H rating reflects the two-condition prerequisite, moderating the net risk score to 5.9 Medium despite the unauthenticated network vector.
Splunk Connect for Kafka below version 2.2.7 contains an uncontrolled resource consumption flaw in its HTTP Event Collector retry mechanism, enabling an unauthenticated network attacker who can also manipulate HEC endpoint responses to trigger an infinite retry loop that permanently halts Kafka-to-Splunk event delivery. The vulnerability arises because the connector applies an unbounded default retry count for failed HEC batches rather than a finite limit, causing the connector to stall indefinitely when fed persistent failure responses. No active exploitation has been confirmed - the vulnerability is not in CISA KEV - and no public exploit code has been identified at time of analysis.
Certificate validation bypass in Splunk Connect for Kafka below version 2.2.7 allows a network-positioned unauthenticated attacker to intercept and modify event data in transit to Splunk Enterprise's HTTP Event Collector when Kerberos authentication is configured. The Kerberos code path fails to apply the connector's configured TLS certificate validation options when constructing the HTTP client, effectively negating transport security despite HEC's TLS configuration. No active exploitation has been identified (not in CISA KEV), but the confidentiality and integrity impact on Splunk-ingested telemetry data is high.
Unauthenticated access to the Kafka Connect REST API in Splunk Connect for Kafka versions below 2.2.7 enables an SSRF-class attack that reconfigures the HTTP Event Collector destination to an attacker-controlled endpoint, resulting in theft of HEC authentication credentials and partial manipulation of event delivery to Splunk Enterprise. The connector's HEC endpoint validation does not enforce secure transport by default, meaning a non-TLS HTTP destination can be substituted without any authentication. No public exploit has been identified at time of analysis, but the attack requires no privileges and trivially low complexity, making any deployment with a network-exposed Kafka Connect REST API immediately actionable.
Unauthenticated ReDoS in Splunk Connect for Kafka below version 2.2.7 allows a network-accessible attacker to permanently block a Kafka Connect worker thread by submitting a pathological regular expression via the Kafka Connect REST API, which - when triggered by attacker-supplied or coincident matching event data during timestamp extraction - causes the regex engine to backtrack catastrophically without bound. The practical result is complete stoppage of event delivery for the targeted connector, constituting a targeted denial-of-service against Splunk data ingestion pipelines. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS AC:H rating reflects the two-condition prerequisite, moderating the net risk score to 5.9 Medium despite the unauthenticated network vector.
Splunk Connect for Kafka below version 2.2.7 contains an uncontrolled resource consumption flaw in its HTTP Event Collector retry mechanism, enabling an unauthenticated network attacker who can also manipulate HEC endpoint responses to trigger an infinite retry loop that permanently halts Kafka-to-Splunk event delivery. The vulnerability arises because the connector applies an unbounded default retry count for failed HEC batches rather than a finite limit, causing the connector to stall indefinitely when fed persistent failure responses. No active exploitation has been confirmed - the vulnerability is not in CISA KEV - and no public exploit code has been identified at time of analysis.