CVE-2026-116593
Description
A flaw was found in Apache Kafka Connect. This vulnerability allows information disclosure when a remote attacker accesses the connector configuration validation endpoint. By submitting a request to this endpoint, an attacker can force installed configuration providers to resolve and return sensitive configuration values in plaintext, potentially exposing credentials and secrets.
Statement
This vulnerability is rated as an Important severity flaw because network actors who can reach the Kafka Connect REST interface can leverage configuration provider mechanisms to retrieve sensitive secrets and credentials, resulting in high confidentiality loss. In typical Red Hat deployments, including Red Hat AMQ Streams, Connect workers reside inside protected Kubernetes or OpenShift namespaces without public ingress. Consequently, the operational risk is primarily present when the worker REST API is exposed across untrusted network boundaries or lacks ingress network policy restrictions.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
