org.apache.kafka/connect-runtime vulnerabilities

Latest org.apache.kafka/connect-runtime CVEs

Newest publication first

1. CVE-2026-116593 Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

   Published 2026-10-28

   High·CVSS 8.1 EPSS 0.47%

   Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve th...

2. CVE-2026-115644 Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

   Published 2026-10-28

   High·CVSS 8.8 EPSS 0.52%

   Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring the "admin.listeners...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.