Executive brief
The Microsoft Kafka Connect plugin for Azure Data Explorer (Kusto) is used to move data from Kafka topics into Azure databases. A vulnerability in how the plugin handles configuration settings allows an authorized administrator to inject malicious commands into the database. This could lead to unauthorized data access, modification of database schemas, or changes to data retention policies.
Technical details
The kafka-sink-azure-kusto plugin (prior to version 5.2.3) fails to sanitize user-controlled values within the 'kusto.tables.topics.mapping' configuration. Specifically, the 'db', 'table', 'mapping', and 'format' fields are directly interpolated into Kusto Query Language (KQL) management commands using String.formatted(). An attacker with permissions to modify Kafka Connect connector configurations can inject KQL metacharacters (such as semicolons, pipes, or single quotes) to execute arbitrary management commands. This occurs in the security context of the connector's service principal, potentially allowing for schema modification, data tampering, or policy changes. The issue is resolved in version 5.2.3 by implementing strict regex-based allowlist validation for these configuration fields.
Affected products
- Microsoft kafka-sink-azure-kusto < 5.2.3
Timeline
- 2026-04-04: other: Fix pull request submitted
- 2026-04-17: patched: Version 5.2.3 released
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD