CVE-2026-33558
Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
En bref
- Source
- NVD
- EPSS
- EPSS 0.63 % · centile 50 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Analyzed
Description
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
Faiblesses (CWE)
- CWE-533 — DEPRECATED: Information Exposure Through Server Log Files
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-wf66-mphr-4c4r — Apache Kafka exposes sensitive information in its DEBUG logs
Références européennes
- ENISA EUVD · EUVD-2026-23849
- GCVE · GCVE-0-2026-33558
Avis du CERT-FR
- CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0461 — Multiples vulnérabilités dans Apache Kafka · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 0.11.0.0 < 3.9.2cpe:2.3:a:apache:kafka:4.0.0:-:*:*:*:*:*:*cpe:2.3:a:apache:kafka:4.0.0:rc0:*:*:*:*:*:*cpe:2.3:a:apache:kafka:4.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:apache:kafka:4.0.0:rc3:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache Kafka | affected 0.11.0 ≤ 3.9.1 ; affected 4.0.0 |
| Apache Software Foundation · Apache Kafka Clients | affected 0.11.0 ≤ 3.9.1 ; affected 4.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |