CVE and update status of the FreeBSD ports tree3,534 unaddressed CVEs in 701 portsAll times are CET
CVE details

CVE-2026-116593

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime.  An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.

Score
–
Published
2026-10-28
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net/kafkakafka4.3.1unaddressedtimp87@gmail.com

Template for a VuXML entry

This generator is not reliable at the moment

Package names, ranges and the XML itself can be wrong. Always check the content before you commit it, and run make validate in security/vuxml. The generator is being rewritten from scratch.

Range per package from the CVE record, for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kafka</name>
	<range><lt>4.3.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Kafka Connect has the
	  /connector-plugins/{connector-type}/config/validate endpoint on its
	  REST API to validate connector configurations. Apache Kafka Connect
	  also support Configuration Providers which enable to hide the values
	  of sensitive configuration and only resolve them at runtime.</p>
	<p>An attacker with access to the validate endpoint can use it to resolve
	  and return plaintext values via any of the configuration providers
	  installed on a Connect worker.</p>
	<p>Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or
	  above, which fix this issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-116593</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-116593</url>
    </references>
    <dates>
      <discovery>2026-10-28</discovery>
      <entry>2026-10-28</entry>
    </dates>
  </vuln>