CVE-2026-15911
Received Received - Intake

Confluent Kafka Python Client HashiCorp Vault KMS TLS Validation Bypass

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: IBM Corporation

Description
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-15911
EUVD
EUVD-2026-91008

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
confluent confluent_kafka to 2.15.0 (exc)
confluent confluent_kafka From 2.15.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Confluent Kafka Python client's HashiCorp Vault KMS integration, where TLS certificate verification is disabled by default in the client's HTTP connection to Vault. This allows a remote attacker to intercept traffic, impersonate the Vault server, and capture credentials or manipulate responses.

Detection Guidance

To detect this vulnerability, check the version of the confluent-kafka Python client in use. Run: pip show confluent-kafka. If the version is 2.14.2 or earlier and HashiCorp Vault KMS integration is enabled, the system is vulnerable.

Impact Analysis

A network-positioned attacker could exploit this to intercept sensitive data, steal credentials, or alter responses. Users of confluent-kafka (Python) versions 2.14.2 and earlier with HashiCorp Vault KMS over HTTPS are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must address it to maintain compliance.

Mitigation Strategies

Upgrade the confluent-kafka Python client to version 2.15.0 or later. This version enables TLS certificate verification by default and provides options for custom CA bundles and mutual TLS.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart