CVE-2026-115644

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115644", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-23T03:48:31.242Z", "datePublished": "2026-10-28T16:45:36.440Z", "dateUpdated": "2026-11-05T17:16:42.585Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:45:36.440Z"}, "title": "Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "packageURL": "pkg:maven/org.apache.kafka/connect-runtime", "versions": [{"status": "affected", "version": "2.4.0", "lessThan": "4.2.2", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.2", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.kafka:connect-runtime"}], "descriptions": [{"value": "Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.\n\nWhen operators isolate the admin REST API by explicitly configuring the \"admin.listeners\" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.\n\nWhile the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.\n\nImpact:\n\nAn unauthenticated attacker with network access to the admin listener can:\n\n 1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use.\n 2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress\n logging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.\n\nMitigation:\n\n Users who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.\n\nResolution:\n\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the\u00a0REST extensions specified via \"rest.extension.classes\" will also apply to\u00a0\"admin.listeners\".", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.</div><div>When operators isolate the admin REST API by explicitly configuring the \"admin.listeners\" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.<br><br>While the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.</div><div>Impact:</div><div>An unauthenticated attacker with network access to the admin listener can:<br><br> 1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use.<br> 2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress<br> logging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.</div><div>Mitigation:<br><br> Users who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.</div><div>Resolution:</div><div><br><div>From Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the&nbsp;REST extensions specified via \"rest.extension.classes\" will also apply to&nbsp;\"admin.listeners\".</div></div>"}]}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Bart\u0142omiej Dmitruk <bartek@striga.ai>, Striga", "type": "reporter"}, {"lang": "en", "value": "Mickael Maison <mickael.maison@gmail.com>", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/15"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T20:07:00.157Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-288", "lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T17:16:29.482474Z", "id": "CVE-2026-115644", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:16:42.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/15"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T20:07:00.157Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-115644", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T17:16:29.482474Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T17:15:37.762Z"}}], "cna": {"title": "Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Bart\u0142omiej Dmitruk <bartek@striga.ai>, Striga"}, {"lang": "en", "type": "remediation developer", "value": "Mickael Maison <mickael.maison@gmail.com>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "versions": [{"status": "affected", "version": "2.4.0", "lessThan": "4.2.2", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.2", "versionType": "semver"}], "packageURL": "pkg:maven/org.apache.kafka/connect-runtime", "packageName": "org.apache.kafka:connect-runtime", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.\n\nWhen operators isolate the admin REST API by explicitly configuring the \"admin.listeners\" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.\n\nWhile the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.\n\nImpact:\n\nAn unauthenticated attacker with network access to the admin listener can:\n\n 1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use.\n 2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress\n logging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.\n\nMitigation:\n\n Users who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.\n\nResolution:\n\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the\u00a0REST extensions specified via \"rest.extension.classes\" will also apply to\u00a0\"admin.listeners\".", "supportingMedia": [{"type": "text/html", "value": "<div>Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.</div><div>When operators isolate the admin REST API by explicitly configuring the \"admin.listeners\" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.<br><br>While the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.</div><div>Impact:</div><div>An unauthenticated attacker with network access to the admin listener can:<br><br> 1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use.<br> 2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress<br> logging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.</div><div>Mitigation:<br><br> Users who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.</div><div>Resolution:</div><div><br><div>From Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the&nbsp;REST extensions specified via \"rest.extension.classes\" will also apply to&nbsp;\"admin.listeners\".</div></div>", "base64": false}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:45:36.440Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115644", "state": "PUBLISHED", "dateUpdated": "2026-11-05T17:16:42.585Z", "dateReserved": "2026-10-23T03:48:31.242Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-28T16:45:36.440Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kafka:connect-runtime", "packageURL": "pkg:maven/org.apache.kafka/connect-runtime", "product": "Apache Kafka", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.2.2", "status": "affected", "version": "2.4.0", "versionType": "semver"}, {"lessThan": "4.3.2", "status": "affected", "version": "4.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.\n\nWhen operators isolate the admin REST API by explicitly configuring the \"admin.listeners\" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.\n\nWhile the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.\n\nImpact:\n\nAn unauthenticated attacker with network access to the admin listener can:\n\n 1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use.\n 2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress\n logging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.\n\nMitigation:\n\n Users who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.\n\nResolution:\n\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the\u00a0REST extensions specified via \"rest.extension.classes\" will also apply to\u00a0\"admin.listeners\"."}], "id": "CVE-2026-115644", "lastModified": "2026-11-05T18:17:02.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115644", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T17:16:29.482474Z", "version": "2.0.3"}}]}, "published": "2026-10-28T17:18:00.630", "references": [{"source": "security@apache.org", "url": "https://kafka.apache.org/cve-list"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/28/15"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.kafka/connect-runtime: Apache Kafka Connect: Authentication bypass via separate admin listener", "id": "2563016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563016"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-306", "details": ["Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.\nWhen operators isolate the admin REST API by explicitly configuring the \"admin.listeners\" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration.\nWhile the primary REST API listener (configured via listeners) enforces configured authentication and authorization filters, endpoints mounted under the separate admin listener (/admin/loggers) fail to inherit or instantiate these extension filters. As a result, the admin logger endpoint accepts unauthenticated read and write requests even when security extensions are active on the main listener.\nImpact:\nAn unauthenticated attacker with network access to the admin listener can:\n1. Read the complete set of logger names and levels, disclosing loaded class names and which security extensions are in use.\n2. Write logger levels, including with scope=cluster which propagates the change to all workers in the Connect cluster. This can be used to suppress\nlogging (setting root to OFF) or generate excessive log output (setting root to TRACE), potentially impacting availability and observability.\nMitigation:\nUsers who cannot upgrade immediately can remove the admin.listeners configuration (or leave it unset). When unset, admin resources share the regular listener and inherit its security extensions.\nResolution:\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the\u00a0REST extensions specified via \"rest.extension.classes\" will also apply to\u00a0\"admin.listeners\".", "A flaw was found in Apache Kafka Connect. When a dedicated network listener is configured for administrative services, configured security and authentication extensions are not applied to the administrative endpoints. An unauthenticated remote attacker with network access to this administrative interface can exploit this vulnerability to modify log levels across the cluster or access internal logging configurations. This allows an attacker to suppress critical audit trails or generate excessive log output, potentially resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, remove or comment out the `admin.listeners` property in the Kafka Connect worker configuration file (`connect-distributed.properties` or `connect-standalone.properties`). When `admin.listeners` is unset, administrative endpoints share the primary listener interface and inherit its configured security extensions:\n```properties\n# admin.listeners=http://localhost:8083\n```\nAlternatively, restrict network reachability to the administrative listener port using host firewall rules (such as `firewalld`) or network access controls so that only trusted management networks can access it:\n```bash\nfirewall-cmd --permanent --zone=internal --add-port=<ADMIN_PORT>/tcp\nfirewall-cmd --reload\n```\nCaveats:\nUnsetting the separate administrative listener consolidates administrative endpoints onto the primary listener address and port. Applying worker configuration changes requires restarting Kafka Connect services (`systemctl restart ...`), which will temporarily interrupt connector execution and data processing."}, "name": "CVE-2026-115644", "package_state": [{"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "connect-runtime", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "connect-runtime", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "connect-runtime", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-10-28T16:45:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115644\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115644\nhttps://kafka.apache.org/cve-list"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires a specific non-default configuration where an isolated admin listener is configured alongside custom REST security extensions, and unauthorized access is constrained to reading and modifying logger levels. Standard Kafka Connect deployments that do not define a separate administrative listener or that run without security extensions are unaffected, as administrative endpoints inherit the security controls applied to the primary listener. Although an unauthorized attacker reaching the admin port can tamper with worker logging levels across a cluster to obscure activity or cause resource exhaustion, the vulnerability does not provide direct access to Kafka topics, connector configurations, or internal data streams.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.4.0,4.2.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.3.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Kafka", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kafka", "vendor": "apache"}], "created": "2026-10-28T19:15:14.768818+00:00", "updated": "2026-11-05T20:15:12.893202+00:00", "vendors": ["apache", "apache$PRODUCT$kafka"], "weaknesses": ["CWE-288", "CWE-306"]}