CVE-2026-112375
개요
A flaw was found in Apache Kafka. Broker configuration update requests are validated before authorization checks are performed, allowing arbitrary configuration providers to resolve variables and bypass security controls. An authenticated user without authorization privileges can exploit this flaw by sending a crafted configuration request, causing the broker host to read local files or environment variables and return their contents in error responses. This can lead to information disclosure of sensitive system data, including credentials and keystores.
내용
This vulnerability is rated as Moderate severity because exploitation requires an attacker to possess valid credentials to authenticate to the Kafka cluster, even though specific authorization grants are not needed. Successful exploitation is limited to unauthorized information disclosure of files and environment variables accessible to the broker service account, without permitting remote code execution, cluster manipulation, or denial of service. Red Hat products deploying Apache Kafka run broker processes under dedicated, least-privileged service accounts, restricting the scope of readable host files.
취약점 이해 (CWE)
Confidentiality
Technical Impact: Read Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
