CVE-2026-76400

Received Received - Intake

Unauthenticated Batch Retry in Splunk Connect for Kafka

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76400

EUVD

EUVD-2026-62965

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_connect_for_kafka	to 2.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Connect for Kafka versions below 2.2.7. An unauthenticated user with access to the Kafka Connect REST API and the ability to influence HTTP Event Collector responses in Splunk Enterprise could cause the connector to retry failed event batches indefinitely. This happens because the retry mechanism for failed batches lacks a finite limit, leading to unbounded retries and eventual stopping of event delivery.

Detection Guidance

Detecting this vulnerability requires checking the version of Splunk Connect for Kafka and monitoring for unbounded retry loops in HTTP Event Collector responses. Verify the installed version with: splunk-connect-for-kafka --version. Inspect Kafka Connect REST API logs for repeated retry attempts without finite limits on failed batches.

Impact Analysis

This vulnerability could lead to denial of service by preventing event data from being delivered to Splunk Enterprise. Systems relying on timely data ingestion may experience disruptions or complete failure in processing events, impacting monitoring and operational visibility.

Compliance Impact

This vulnerability could impact compliance by causing data processing delays or failures, potentially violating requirements for timely data handling and reporting. Organizations may fail to meet regulatory deadlines or maintain accurate records if event data is not delivered as expected.

Mitigation Strategies

Upgrade Splunk Connect for Kafka to version 2.2.7 or later. Configure HTTP Event Collector with finite retry limits for failed batches. Restrict network access to the Kafka Connect REST API to prevent unauthenticated user influence.

Hi! I’m here to help you understand CVE-2026-76400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70