CVE-2026-115644

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 4.2.2 Apache Kafka versions prior to 4.3.2 Apache Kafka versions prior to 4.4.0

Description An authentication bypass exists in the admin REST API when the admin.listeners property is configured separately from the main listeners property. In this configuration, REST extensions defined via rest.extension.classes, such as BasicAuthSecurityRestExtension, are not applied to the admin resource configuration. Consequently, the /admin/loggers endpoint does not inherit authentication and authorization filters, allowing unauthenticated users with network access to the admin listener to read logger names and levels or modify logger levels across the cluster. This could lead to the disclosure of loaded class names and security extensions, or impact availability and observability by suppressing or inflating log output.

Recommendations Update to version 4.2.2, 4.3.2, or 4.4.0. As a temporary workaround, remove or unset the admin.listeners configuration so that admin resources share the regular listener and its security extensions.