CVE-2026-76403

Received Received - Intake

Kerberos Authentication Bypass in Splunk Connect for Kafka

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate validation options when it builds the HTTP client. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Security configurations for Splunk Connect for Kafka (https://help.splunk.com/en/splunk-enterprise/get-data-in/splunk-connect-for-kafka/2.2/configure/security-configurations-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76403

EUVD

EUVD-2026-62968

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_connect_for_kafka	to 2.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Connect for Kafka versions below 2.2.7. When Kerberos authentication is used with HTTP Event Collector in Splunk Enterprise, an unauthenticated user in the network path could read or alter all relevant data sent from the connector. This happens because the Kerberos authentication path does not apply configured certificate validation options when building the HTTP client.

Impact Analysis

An attacker could intercept and read sensitive data transmitted by the connector or modify it before it reaches Splunk Enterprise. This could lead to data breaches, unauthorized access to information, or tampering with critical data streams.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions may face regulatory penalties or loss of compliance certifications.

Mitigation Strategies

Upgrade Splunk Connect for Kafka to version 2.2.7 or later to address the Kerberos authentication and certificate validation issue.

Hi! I’m here to help you understand CVE-2026-76403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70