CVE-2026-115644
Description
A flaw was found in Apache Kafka Connect. When a dedicated network listener is configured for administrative services, configured security and authentication extensions are not applied to the administrative endpoints. An unauthenticated remote attacker with network access to this administrative interface can exploit this vulnerability to modify log levels across the cluster or access internal logging configurations. This allows an attacker to suppress critical audit trails or generate excessive log output, potentially resulting in a denial of service.
Statement
This vulnerability is rated as Moderate impact because exploitation requires a specific non-default configuration where an isolated admin listener is configured alongside custom REST security extensions, and unauthorized access is constrained to reading and modifying logger levels. Standard Kafka Connect deployments that do not define a separate administrative listener or that run without security extensions are unaffected, as administrative endpoints inherit the security controls applied to the primary listener. Although an unauthorized attacker reaching the admin port can tamper with worker logging levels across a cluster to obscure activity or cause resource exhaustion, the vulnerability does not provide direct access to Kafka topics, connector configurations, or internal data streams.
Mitigation
To mitigate this vulnerability, remove or comment out the `admin.listeners` property in the Kafka Connect worker configuration file (`connect-distributed.properties` or `connect-standalone.properties`). When `admin.listeners` is unset, administrative endpoints share the primary listener interface and inherit its configured security extensions:
properties
# admin.listeners=http://localhost:8083
Alternatively, restrict network reachability to the administrative listener port using host firewall rules (such as `firewalld`) or network access controls so that only trusted management networks can access it:
bash
firewall-cmd --permanent --zone=internal --add-port=<ADMIN_PORT>/tcp
firewall-cmd --reload
Caveats:
Unsetting the separate administrative listener consolidates administrative endpoints onto the primary listener address and port. Applying worker configuration changes requires restarting Kafka Connect services (`systemctl restart ...`), which will temporarily interrupt connector execution and data processing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.6 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | Low | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
