CVE-2026-115644

{
  "etk_id": "ETK-2026-2897",
  "cve_id": "CVE-2026-115644",
  "display_id": "CVE-2026-115644",
  "ghsa_id": "GHSA-jmxh-862m-3gxj",
  "euvd_id": "EUVD-2026-112173",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Apache Kafka Connect admin REST API",
  "summary": "Kafka Connect deployments with a separately configured `admin.listeners` endpoint may leave admin logger operations outside the configured REST authentication and authorization extensions. An unauthenticated network client could view logger settings or change logger levels, affecting information exposure, logging visibility, or resource use.",
  "mitigation": "Upgrade Apache Kafka to 4.2.2, 4.3.2, or 4.4.0, as applicable. Until upgraded, remove or unset `admin.listeners` so administrative resources use the primary listener's security controls, and limit network access to that listener.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Kafka",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.4.0, < 4.2.2",
        ">= 4.3.0, < 4.3.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.2.2",
        "4.3.2"
      ],
      "package_name": "org.apache.kafka:connect-runtime",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 71.38778246666666,
  "t0_at": "2026-10-28T16:45:36.440000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T16:45:36.440000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T16:45:36.440000+00:00",
      "url": "https://github.com/advisories/GHSA-jmxh-862m-3gxj"
    }
  }
}