CVE and update status of the FreeBSD ports tree3,534 unaddressed CVEs in 701 portsAll times are CET
CVE details

CVE-2026-112375

An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs (or AlterConfigs) request targeting a BROKER resource reaches the broker's configuration validation before any authorization check is applied to that path. Validation resolves configuration variables such as ${file:/path:key} or ${env:VAR} using a ConfigProvider named in the request, and this resolution bypasses the org.apache.kafka.automatic.config.providers allowlist that was added as the mitigation for CVE-2024-31141. An arbitrary ConfigProvider (for example FileConfigProvider or EnvVarConfigProvider) is therefore instantiated and the referenced file or environment variable is read, and a type-validation error returns the resolved content to the caller. Impact: On a cluster with an authorizer enabled, an authenticated principal with no authorization grants can read the contents of files accessible to the broker process, and the broker's environment variables, exposing credentials, keystores, or other secrets, defeating the CVE-2024-31141 allowlist. The read is bounded by the broker process's file permissions. The brokers and the cluster remain available; the issue is disclosure of file and environment- variable contents. Clusters with no authorizer configured are not affected in practice, because every principal already holds ALTER_CONFIGS there. Mitigation: Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. As defense in depth, run brokers under a least-privileged operating-system account so that sensitive files are not readable by the broker process. Resolution: From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: broker configuration changes are authorized (ALTER_CONFIGS on the cluster) before the configuration is validated, and configuration- variable resolution enforces the config-providers allowlist.

Score
–
Published
2026-10-28
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net/kafkakafka4.3.1unaddressedtimp87@gmail.com

Template for a VuXML entry

This generator is not reliable at the moment

Package names, ranges and the XML itself can be wrong. Always check the content before you commit it, and run make validate in security/vuxml. The generator is being rewritten from scratch.

Range per package from the CVE record, for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kafka</name>
	<!-- no fixed version in the CVE record -->
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An authenticated Kafka principal with no authorization grants (not
	  even ALTER_CONFIGS) can make a broker read a file or an environment
	  variable from the broker host and return its contents. An
	  IncrementalAlterConfigs (or AlterConfigs) request targeting a BROKER
	  resource reaches the broker's configuration validation before any
	  authorization check is applied to that path. Validation resolves
	  configuration variables such as ${file:/path:key} or ${env:VAR} using
	  a ConfigProvider named in the request, and this resolution bypasses
	  the org.apache.kafka.automatic.config.providers allowlist that was
	  added as the mitigation for CVE-2024-31141. An arbitrary
	  ConfigProvider (for example FileConfigProvider or
	  EnvVarConfigProvider) is therefore instantiated and the referenced
	  file or environment variable is read, and a type-validation error
	  returns the resolved content to the caller.</p>
	<p>Impact:</p>
	<p>On a cluster with an authorizer enabled, an authenticated principal
	  with no authorization grants can read the contents of files accessible
	  to the broker process, and the broker's environment variables,
	  exposing credentials, keystores, or other secrets, defeating the
	  CVE-2024-31141 allowlist. The read is bounded by the broker process's
	  file permissions. The brokers and the cluster remain available; the
	  issue is disclosure of file and environment- variable contents.
	  Clusters with no authorizer configured are not affected in practice,
	  because every principal already holds ALTER_CONFIGS there.</p>
	<p>Mitigation:</p>
	<p>Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. As defense in depth,
	  run brokers under a least-privileged operating-system account so that
	  sensitive files are not readable by the broker process.</p>
	<p>Resolution:</p>
	<p>From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: broker configuration
	  changes are authorized (ALTER_CONFIGS on the cluster) before the
	  configuration is validated, and configuration- variable resolution
	  enforces the config-providers allowlist.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-112375</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-112375</url>
    </references>
    <dates>
      <discovery>2026-10-28</discovery>
      <entry>2026-10-28</entry>
    </dates>
  </vuln>