PUBLISHED
2026-04-20 14:16
MODIFIED
2026-04-20 14:16
EPSS (Prob. Exploit)
0.63%
Top 49.5%
> DESCRIPTION
Information exposure vulnerability has been identified in Apache Kafka.
The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are:
* AlterConfigsRequest
* AlterUserScramCredentialsRequest
* ExpireDelegationTokenRequest
* IncrementalAlterConfigsRequest
* RenewDelegationTokenRequest
* SaslAuthenticateRequest
* createDelegationTokenResponse
* describeDelegationTokenResponse
* SaslAuthenticateResponse
This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-533: DEPRECATED: Information Exposure Through Server Log Files - This entry has been deprecated because its abstraction was too low-level. See CWE-532.
> GITHUB SECURITY ADVISORY
GHSA-wf66-mphr-4c4r
MODERATE
Apache Kafka exposes sensitive information in its DEBUG logs
AFFECTED PACKAGES:
MAVEN / org.apache.kafka:kafka-clients
= 4.0.0
Fixed in: 4.0.1
MAVEN / org.apache.kafka:kafka-clients
>= 0.11.0, < 3.9.2
Fixed in: 3.9.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
AFFECTED PACKAGES:
Unknown / Unknown
4 versions affected
ALIASES:
BIT-kafka-2026-33558, GHSA-wf66-mphr-4c4r
> HISTORIQUE DES MODIFICATIONS
Première apparition
20/04/2026 14:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-533: DEPRECATED: Information Exposure Through Server Log Files - This entry has been deprecated because its abstraction was too low-level. See CWE-532.
Total des modifications: 1
Dernière mise à jour: 6 months ago