CVE-2026-15911
Description
A flaw was found in confluent-kafka. The HashiCorp Vault Key Management Service (KMS) integration fails to properly validate Transport Layer Security (TLS) certificates by default. A remote attacker able to intercept network traffic could exploit this flaw to intercept and decrypt sensitive data or tamper with communications between the client and the Vault service.
Statement
An IMPORTANT severity flaw (CVSS 3.1 base score 7.4, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) was found in the confluent-kafka Python client's HashiCorp Vault Key Management Service (KMS) integration, which is used for Schema Registry client-side field-level encryption (CSFLE). The client's HTTPS connection to the Vault service has Transport Layer Security (TLS) certificate verification disabled by default, with no configuration option exposed to re-enable it. A remote attacker in a privileged network position, able to intercept traffic between an affected application and its Vault server, could impersonate the Vault server with any certificate, including a self-signed one, to capture Vault access tokens and AppRole credentials in transit or to return manipulated responses affecting KMS key wrap and unwrap operations. Exploitation requires no application-level authentication, but it does require a man-in-the-middle position on the network path between the client and the Vault service. Only the HashiCorp Vault KMS integration is affected; the AWS, Google Cloud, and Azure KMS integrations in the same package verify certificates by default and are not affected. Red Hat Satellite and Red Hat Insights (cloud.redhat.com) components that bundle the affected confluent-kafka Python package are listed as affected, and fixes are being pursued by the responsible product teams. The Red Hat severity rating of IMPORTANT matches the upstream CVSS rating.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. There is no configuration workaround in affected versions because TLS certificate verification is hardcoded to disabled. The upstream confluent-kafka Python package addressed this issue in version 2.15.0, which enables TLS certificate verification by default and allows supplying a CA bundle through the ssl.ca.location configuration option or the VAULT_CACERT environment variable for Vault servers that present certificates signed by a private or internal certificate authority. Updating to a version of the confluent-kafka Python package that enables TLS certificate verification, or updating affected Red Hat products once they incorporate the fixed version, is the recommended resolution.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 7.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
