CVE-2026-112375

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 4.2.2 Apache Kafka versions prior to 4.3.2 Apache Kafka versions prior to 4.4.0

Description An authenticated principal with no authorization grants can force a broker to read and return the contents of a file or an environment variable from the broker host. This occurs because IncrementalAlterConfigs or AlterConfigs requests targeting a BROKER resource undergo configuration validation before authorization checks are applied. During this process, the system resolves configuration variables using a ConfigProvider specified in the request, bypassing the established allowlist. This allows the instantiation of arbitrary providers, such as FileConfigProvider or EnvVarConfigProvider, which can then expose sensitive data like credentials or keystores through type-validation errors. The impact is limited to files and environment variables accessible to the broker process's operating-system permissions.

Recommendations Upgrade to Apache Kafka version 4.2.2. Upgrade to Apache Kafka version 4.3.2. Upgrade to Apache Kafka version 4.4.0. Run brokers under a least-privileged operating-system account to ensure sensitive files are not readable by the broker process.