CVE-2026-76402

Received Received - Intake

Information Disclosure in Splunk Connect for Kafka

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise that causes the connector to send authentication credentials to an attacker-controlled server, allowing for exposure of credentials that compromise all relevant data sent through the connector and limited alteration of event delivery. The vulnerability is possible because HTTP Event Collector endpoint validation does not require secure transport by default. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76402

EUVD

EUVD-2026-62967

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_connect_for_kafka	to 2.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Connect for Kafka versions below 2.2.7. An unauthenticated user with access to the Kafka Connect REST API can configure an insecure HTTP Event Collector endpoint in Splunk Enterprise. This causes the connector to send authentication credentials to an attacker-controlled server, potentially exposing sensitive data and allowing limited alteration of event delivery.

Detection Guidance

Check Splunk Connect for Kafka logs for unauthorized HTTP Event Collector endpoint configurations. Review network traffic for outbound connections to unknown servers from the Kafka Connect REST API. Inspect Splunk Enterprise configuration files for HTTP Event Collector endpoints with insecure transport settings.

Impact Analysis

The impact includes exposure of authentication credentials, which could compromise all data sent through the connector. Attackers may gain access to sensitive information and could alter event delivery, leading to data integrity issues.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR and HIPAA. Exposure of credentials and data breaches may result in legal penalties and loss of trust.

Mitigation Strategies

Upgrade Splunk Connect for Kafka to version 2.2.7 or later. Ensure HTTP Event Collector endpoints enforce secure transport (HTTPS) and validate server certificates. Restrict access to the Kafka Connect REST API to trusted networks or users. Review and remove any unauthorized HTTP Event Collector configurations.

Hi! I’m here to help you understand CVE-2026-76402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70