Executive brief
Splunk Connect for Kafka is a data integration connector that streams messages from Apache Kafka into Splunk Enterprise for analysis. An unauthenticated attacker who can reach the connector's REST API could reconfigure it to send data and authentication credentials to an attacker-controlled server, leading to credential theft and potential data exposure or manipulation of all events processed through the connector.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Splunk Connect for Kafka versions below 2.2.7. An unauthenticated attacker with network access to the Kafka Connect REST API can configure the connector to use a non-secure HTTP endpoint for the Splunk HTTP Event Collector. Due to insufficient validation of the endpoint URL, the connector does not verify that the endpoint uses HTTPS and does not validate the certificate, allowing an attacker to intercept traffic and capture authentication credentials sent by the connector. An attacker can achieve credential theft, data exposure of all events sent through the connector, and limited manipulation of event delivery. The vulnerability is fixed in version 2.2.7 and later, where HTTPS is enforced by default and certificate validation is implemented.
Affected products
- Splunk Connect for Kafka below 2.2.7
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 2.2.7