# CVE-2026-76403: Splunk Connect for Kafka improper certificate validation in Kerberos authentication

Source: https://junglewise.ai/threats/cve-2026-76403-splunk-connect-for-kafka-improper-certificate-validation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76403 · Severity: high · CVSS 7.4 · Published 2026-08-19

Splunk Connect for Kafka is a connector that ships data from Apache Kafka to Splunk Enterprise for analysis. An attacker positioned on the network path between Kafka and Splunk can intercept, read, or modify all data in transit when Kerberos authentication is combined with HTTP Event Collector, because certificate validation is bypassed in this authentication flow. This could expose sensitive business data or allow tampering with log records used for compliance and investigation.

Technologies: [Splunk Connect For Kafka](https://junglewise.ai/threats/technologies/connect-for-kafka). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76403 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76403 being exploited in the wild.

**How severe is CVE-2026-76403?** High severity, with a CVSS score of 7.4, published 19 August 2026.

**Which products and versions are affected?** Splunk Connect For Kafka below 2.2.7.

**Is there a fix for CVE-2026-76403?** A patch was published on 2026-08-19: Fixed in version 2.2.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76403 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-76403?** Check whether you run Splunk Connect For Kafka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper certificate validation flaw (CWE-295) in the Kerberos authentication path of Splunk Connect for Kafka versions below 2.2.7. When configuring Kerberos authentication with HTTP Event Collector, the connector fails to apply configured certificate validation options when building the HTTP client, leaving the connection susceptible to man-in-the-middle (MITM) attacks. An attacker positioned on the network path can intercept and decrypt HTTPS traffic, or inject malicious content without detection. The attack requires network proximity to the data path but no authentication credentials. The vulnerability was fixed in version 2.2.7.

## Affected products

- Splunk Connect for Kafka below 2.2.7

## Timeline

- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 2.2.7

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0808](https://advisory.splunk.com/advisories/SVD-2026-0808)

## Related threats

- [Splunk Connect for Kafka server-side request forgery via REST API](https://junglewise.ai/threats/cve-2026-76402-splunk-connect-for-kafka-server-side-request-forgery-via-rest-api)
- [Splunk Connect for Kafka regular expression denial of service](https://junglewise.ai/threats/cve-2026-76401-splunk-connect-for-kafka-regular-expression-denial-of-service)
- [Splunk Connect for Kafka denial of service in REST API](https://junglewise.ai/threats/cve-2026-76400-splunk-connect-for-kafka-denial-of-service-in-rest-api)