Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate validation options when it builds the HTTP client. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Security configurations for Splunk Connect for Kafka (https://help.splunk.com/en/splunk-enterprise/get-data-in/splunk-connect-for-kafka/2.2/configure/security-configurations-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T22:17:27.043Z",
  "pubdate": "2026-08-19T22:17:27.043Z",
  "executiveSummary": "Splunk Connect for Kafka versions below 2.2.7 are affected by a certificate validation bypass vulnerability within the Kerberos authentication mechanism used alongside the HTTP Event Collector in Splunk Enterprise.\nThis security defect allows an unauthenticated adversary positioned in the network path to execute Adversary-in-the-Middle (AitM) attacks, enabling them to intercept, read, or alter all relevant data transmitted from the connector.\nThe risk implications are severe, as sensitive data streams in transit are exposed to unauthorized disclosure and tampering.\nExploitation requires the attacker to be positioned in the network path between the Kafka connector and Splunk Enterprise, and relies specifically on configurations where Kerberos authentication is utilized with the HTTP Event Collector.\nAffected systems involve deployments of Splunk Connect for Kafka prior to version 2.2.7.",
  "technicalDetails": "The root cause of the vulnerability lies in improper certificate validation handling within the codebase.\nSpecifically, when Kerberos authentication is configured for the HTTP Event Collector in Splunk Enterprise, the authentication code path fails to apply the configured certificate validation options during the instantiation and configuration of the underlying HTTP client.\nBecause the HTTP client bypasses proper X.509 certificate validation checks, it blindly trusts TLS/SSL certificates presented by endpoints along the network path.\nAn unauthenticated attacker situated in the network path can leverage standard network interception techniques, such as ARP spoofing, DNS poisoning, or routing manipulation, to position themselves as an active intermediary between the Splunk Connect for Kafka connector and the Splunk Enterprise instance.\nWhen the connector initiates an HTTP connection utilizing Kerberos authentication to send data to the HTTP Event Collector, the attacker can present an arbitrary or self-signed TLS certificate.\nDue to the absence of enforced certificate validation in the vulnerable Kerberos code path, the Kafka connector accepts the fraudulent certificate without generating validation errors or aborting the connection.\nThis establishes a compromised encrypted session between the connector and the attacker, allowing the attacker to decrypt, read, modify, or forge data payloads in transit.\nThe vulnerable component is the HTTP client initialization logic within the Kerberos authentication path of Splunk Connect for Kafka versions below 2.2.7.\nThe attack requires network exposure along the communication path between the affected Kafka connector and Splunk Enterprise, requires no authentication or privileges for the network adversary, and results in full confidentiality and integrity compromise of the data transmitted via the connector."
}