Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise that causes the connector to send authentication credentials to an attacker-controlled server, allowing for exposure of credentials that compromise all relevant data sent through the connector and limited alteration of event delivery. The vulnerability is possible because HTTP Event Collector endpoint validation does not require secure transport by default. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-19T22:17:26.910Z",
  "pubdate": "2026-08-19T22:17:26.910Z",
  "executiveSummary": "Splunk Connect for Kafka contains a credential exposure vulnerability affecting versions below 2.2.7, resulting from improper configuration validation of the HTTP Event Collector endpoint.\nThe vulnerability allows an unauthenticated, network-adjacent or remote attacker who can reach the Kafka Connect Representational State Transfer (REST) API to configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint.\nUpon successful exploitation, the connector transmits authentication credentials to an attacker-controlled server, leading to the exposure of sensitive credentials that compromise all relevant data transmitted through the connector.\nAdditionally, exploitation permits limited alteration of event delivery mechanisms.\nThe core security issue stems from the fact that HTTP Event Collector endpoint validation does not enforce secure transport by default, facilitating interception and credential theft without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides within the HTTP Event Collector endpoint configuration validation logic of Splunk Connect for Kafka in versions below 2.2.7.\nThe root cause is the failure of the component to mandate secure transport protocols by default when configuring HTTP Event Collector endpoints via the Kafka Connect Representational State Transfer (REST) API.\nBecause authentication is not required to reach the vulnerable Kafka Connect Representational State Transfer (REST) API if improperly exposed, an unauthenticated attacker can interact directly with the management interface.\nThe attack flow proceeds as follows: first, the attacker identifies a network path to the exposed Kafka Connect Representational State Transfer (REST) API; second, the attacker submits a configuration payload to define a malicious or non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint within Splunk Enterprise; third, when the connector initializes or processes event data, it attempts to communicate with the configured endpoint.\nBecause secure transport is not enforced, the connector inadvertently transmits sensitive authentication credentials in plaintext or over an unencrypted channel to the attacker-controlled server.\nNetwork exposure of the Kafka Connect Representational State Transfer (REST) API is a primary environmental prerequisite for remote exploitation.\nPost-exploitation impact includes the compromise of authentication credentials, interception of all relevant data sent through the affected connector, and limited alteration of event delivery pipelines.\nAffected versions comprise all instances of Splunk Connect for Kafka prior to version 2.2.7."
}