early signals oss-security infra

CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

// AI summary

Apache Kafka versions 2.4.0 before 4.2.2 and 4.3.0 before 4.3.2 expose Kafka Connect configuration provider values via the validation REST API endpoint (CVE-2026-116593).

// from the source

Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 2.4.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access to the...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org