CVE-2026-33558
Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
At a glance
- Source
- NVD
- EPSS
- EPSS 0.63 % · percentile 50 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Analyzed
Description
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-wf66-mphr-4c4r — Apache Kafka exposes sensitive information in its DEBUG logs
European references
- ENISA EUVD · EUVD-2026-23849
- GCVE · GCVE-0-2026-33558
CERT-FR advisories
- CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0461 — Multiples vulnérabilités dans Apache Kafka · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 0.11.0.0 < 3.9.2cpe:2.3:a:apache:kafka:4.0.0:-:*:*:*:*:*:*cpe:2.3:a:apache:kafka:4.0.0:rc0:*:*:*:*:*:*cpe:2.3:a:apache:kafka:4.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:apache:kafka:4.0.0:rc3:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Kafka | affected 0.11.0 ≤ 3.9.1 ; affected 4.0.0 |
| Apache Software Foundation · Apache Kafka Clients | affected 0.11.0 ≤ 3.9.1 ; affected 4.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |