oss-security - CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAMVt_AxqL3AKtXqXbReptDaXAMmVPusMJNDFyEJa-SQ1_zP8NA@mail.gmail.com>
Date: Wed, 28 Oct 2026 21:55:55 +0530
From: Manikumar <manikumar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication
 Bypass via Unapplied REST Extensions

Severity: low

Affected versions:

- Apache Kafka 2.4.0 before 4.2.2
- Apache Kafka 4.3.0 before 4.3.2

Description:

Apache Kafka Connect contains an authentication bypass vulnerability
affecting the admin REST API when admin.listeners is configured with a
separate listener from the main listeners property.

When operators isolate the admin REST API by explicitly configuring
the "admin.listeners" property, REST extensions specified via
rest.extension.classes (such as BasicAuthSecurityRestExtension) are
not registered or applied to the admin resource configuration.

While the primary REST API listener (configured via listeners)
enforces configured authentication and authorization filters,
endpoints mounted under the separate admin listener (/admin/loggers)
fail to inherit or instantiate these extension filters. As a result,
the admin logger endpoint accepts unauthenticated read and write
requests even when security extensions are active on the main
listener.

Impact:

An unauthenticated attacker with network access to the admin listener can:

  1. Read the complete set of logger names and levels, disclosing
loaded class names and which security extensions are in use.
  2. Write logger levels, including with scope=cluster which
propagates the change to all workers in the Connect cluster. This can
be used to suppress
     logging (setting root to OFF) or generate excessive log output
(setting root to TRACE), potentially impacting availability and
observability.

Mitigation:

  Users who cannot upgrade immediately can remove the admin.listeners
configuration (or leave it unset). When unset, admin resources share
the regular listener and inherit its security extensions.

Resolution:

>From Apache Kafka 4.2.2, 4.3.2, and 4.4.0, we make sure the REST
extensions specified via "rest.extension.classes" will also apply to
"admin.listeners".

Credit:

Bartłomiej Dmitruk <bartek@...iga.ai>, Striga (reporter)
Mickael Maison <mickael.maison@...il.com> (remediation developer)

References:

https://kafka.apache.org/cve-list
https://www.cve.org/CVERecord?id=CVE-2026-115644

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.