Zero Radar
← feed
HighVulnerabilityCVE-2026-112375updated 28 Oct 2026, 17:46 UTC

Apache Kafka: authenticated users can read broker files and environment variables

A logged-in Kafka user with no special permissions can trick the broker into reading files and environment settings on the server and showing their contents back. Those contents can include passwords and encryption keys.

Fixed in Apache Kafka 4.2.2, 4.3.2, or 4.4.0Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesApache Kafka 4.2.2, 4.3.2, or 4.4.0 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Authenticated userHas valid Kafka credentials, no grants
  2. 2Sends config requestIncrementalAlterConfigs on a BROKER resource
  3. 3Broker resolves variablesValidation runs before authorization check
  4. 4Reads file or env varVia named ConfigProvider, bypassing allowlist
  5. 5Contents returnedSecrets echoed back in validation error
  6. ResultAttacker reads broker secrets

What happened

An IncrementalAlterConfigs or AlterConfigs request targeting a BROKER resource resolves ${file:...} or ${env:...} config variables via a named ConfigProvider before authorization is checked, bypassing the config-providers allowlist added for CVE-2024-31141.

Why it is dangerous: Anyone with valid Kafka credentials on an affected cluster with an authorizer enabled can read secrets such as credentials, keystores, and other files the broker process can access. Operators who rely on the CVE-2024-31141 allowlist for protection are not covered.

Are you affected?

You are affected if you run Apache Kafka 3.2.0 through 4.1.2, 4.2.0 through 4.2.1, or 4.3.0 through 4.3.1 with an authorizer enabled and some authenticated users who are not fully trusted.

Apache Kafka 3.2.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1. Clusters with no authorizer configured are not affected in practice.

What to do

  1. Upgrade Apache Kafka to 4.2.2, 4.3.2, or 4.4.0
  2. Run brokers under a least-privileged operating-system account so sensitive files are not readable by the broker process
  3. Review which authenticated principals have access to the cluster and remove unneeded access

Timeline

  1. 28 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 17:42 UTC
    Reported by oss-security · oss-security
  3. 28 Oct 2026, 17:46 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 17:46 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-112375
Disclosed
28 Oct 2026, 17:17 UTC
On Zero Radar
28 Oct 2026, 17:46 UTC (28 min after disclosure)
Last change
28 Oct 2026, 17:46 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Kafka: authenticated users can read broker files and environment variables · Zero Radar