# CVE-2026-112375: Apache Kafka information disclosure via ConfigProvider in AlterConfigs

Source: https://junglewise.ai/threats/cve-2026-112375-an-authenticated-kafka-principal-with-no-authorization-grants  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-112375 · Severity: info · Published 2026-10-28

Apache Kafka is a distributed messaging system used by enterprises to process and store large data streams. An authenticated user without proper permissions can bypass security controls to read sensitive files and environment variables stored on Kafka broker servers, potentially exposing database credentials, encryption keys, and other secrets. The cluster itself remains operational, but confidential information may be compromised.

Technologies: [Apache Kafka](https://junglewise.ai/threats/technologies/kafka). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-112375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112375 being exploited in the wild.

**How severe is CVE-2026-112375?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Apache Kafka before 4.2.2, 4.3.2, or 4.4.0.

**Is there a fix for CVE-2026-112375?** Yes: fixed in Apache Kafka 4.2.2, 4.3.2, 4.4.0. Until then: Run brokers under a least-privileged operating-system account so that sensitive files are not readable by the broker process, restricting the scope of potential file disclosure. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112375 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-112375?** Check whether you run Apache Kafka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache Kafka 4.2.2, 4.3.2, 4.4.0

Run brokers under a least-privileged operating-system account so that sensitive files are not readable by the broker process, restricting the scope of potential file disclosure.

## Technical details

An IncrementalAlterConfigs or AlterConfigs request targeting a BROKER resource bypasses authorization checks and reaches the configuration validation layer, where ConfigProvider resolution is performed. This resolution instantiates arbitrary ConfigProviders (such as FileConfigProvider or EnvVarConfigProvider) and resolves configuration variables like ${file:/path:key} or ${env:VAR}, bypassing the org.apache.kafka.automatic.config.providers allowlist. The resolved content is returned in a type-validation error message, allowing an authenticated principal to read any file or environment variable accessible to the broker process.

## Affected products

- Apache Kafka before 4.2.2, 4.3.2, or 4.4.0

## Timeline

- 2026-10-28: disclosed

## Related threats

- [Apache Kafka incorrect operator in FetchSnapshot RPC handler](https://junglewise.ai/threats/cve-2026-83525-incorrect-operator-cwe-480-in-the-fetchsnapshot-rpc-handler-in)
- [Apache Kafka memory exhaustion in compressed record batch decoding](https://junglewise.ai/threats/cve-2026-114349-when-a-broker-decodes-a-compressed-record-batch-the-per-record)
- [Apache Kafka deserialization denial of service via oversized allocation](https://junglewise.ai/threats/cve-2026-111551-several-kafka-deserialization-paths-read-a-size-or-count-field)
- [Apache Kafka unbounded tagged-field allocation in flexible protocol headers](https://junglewise.ai/threats/cve-2026-111115-apache-kafka-s-code-generated-readers-for-flexible-protocol)
- [Apache Kafka denial of service in protocol parsing](https://junglewise.ai/threats/cve-2026-111108-apache-kafka-s-code-generated-protocol-readers-pre-size-an-array)