CVE-2026-76402: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. in Splunk Splunk Connect for Kafka

In Splunk Connect for Kafka versions >=2.2 and <2.2.7, the connector retrieves URLs from upstream components without sufficient validation that the destination is trusted. An unauthenticated user able to reach the Kafka Connect REST API can configure a non-secure HTTP Event Collector endpoint, causing the connector to send authentication credentials to an attacker-controlled server. This leads to credential exposure compromising all relevant data sent through the connector and allows limited alteration of event delivery. The root cause is the lack of enforced secure transport (HTTPS) for the HTTP Event Collector endpoint by default.

The vulnerability allows an unauthenticated attacker with network access to the Kafka Connect REST API to cause credential leakage by configuring a non-secure HTTP Event Collector endpoint. This compromises confidentiality of authentication credentials and the integrity of event data sent through the connector, potentially impacting all relevant data ingestion. The impact is rated high with a CVSS score of 8.2, reflecting network attack vector, no privileges required, no user interaction, high confidentiality impact, and limited integrity impact.

A fixed version is available starting from version 2.2.7. Users should upgrade Splunk Connect for Kafka to version 2.2.7 or later to remediate this vulnerability. Until upgrading, ensure that HTTP Event Collector endpoints are configured to require secure transport (HTTPS) to prevent credential exposure. Review and restrict access to the Kafka Connect REST API to trusted users only. Patch status is confirmed by the version range indicating fixed in 2.2.7.