Executive brief
Splunk Connect for Kafka is a connector that ingests data from Apache Kafka into Splunk Enterprise. An unauthenticated attacker who can reach the Kafka Connect REST API and influence HTTP Event Collector responses can force the connector to retry failed event batches indefinitely, causing it to consume excessive resources and stop delivering events. This results in data ingestion failures and service disruption.
Technical details
The vulnerability is an unbounded retry mechanism (CWE-400) in the HTTP Event Collector delivery retry handling within Splunk Connect for Kafka versions below 2.2.7. An unauthenticated attacker with network access to the Kafka Connect REST API can craft requests that influence responses from the HTTP Event Collector endpoint, triggering continuous retry loops for failed event batches without a finite limit. The attack requires network reachability to the REST API and the ability to influence HTTP Event Collector responses. An attacker can achieve denial of service by exhausting connector resources and halting event delivery. The vulnerability is fixed in version 2.2.7 and later.
Affected products
- Splunk Connect for Kafka below 2.2.7
Timeline
- 2026-08-19: disclosed: CVE-2026-76400 published in SVD-2026-0808