Threat Intelligence Database

CVE-2026-76403 is a vulnerability in Splunk Connect for Kafka versions 2.2 and from 2.2 up to but not including 2.2.7. It involves improper or missing validation of certificates when Kerberos authentication is used with the HTTP Event Collector in Splunk Enterprise. This flaw allows an unauthenticated attacker positioned in the network path to read or modify all relevant data sent from the connector. The issue arises because the Kerberos authentication path does not apply the configured certificate validation options when constructing the HTTP client.

CVE-2026-76402 affects Splunk Connect for Kafka versions 2.2 and all versions from 2.2 up to but not including 2.2.7. An unauthenticated attacker with access to the Kafka Connect REST API can configure a non-secure HTTP Event Collector endpoint in Splunk Enterprise. This misconfiguration causes the connector to send authentication credentials to an attacker-controlled server, exposing credentials and allowing limited alteration of event delivery. The vulnerability arises because the HTTP Event Collector endpoint validation does not require secure transport by default.

CVE-2026-76401 is a medium severity vulnerability in Splunk Connect for Kafka versions 2.2 and from 2.2 up to but not including 2.2.7. An unauthenticated attacker who can access the Kafka Connect REST API can exploit this by configuring timestamp extraction with a crafted regular expression that causes inefficient processing. This leads to blocking of a Kafka Connect worker thread and stops event delivery for the affected connector. The root cause is that timestamp extraction evaluates user-supplied regular expressions without a time limit, allowing the worst-case computational complexity to be triggered.

CVE-2026-76400 is a medium severity vulnerability in Splunk Connect for Kafka versions 2.2 and from 2.2 up to but not including 2.2.7. It allows an unauthenticated user who can access the Kafka Connect REST API and influence HTTP Event Collector responses to cause the connector to retry failed event batches indefinitely. This unbounded retry behavior can exhaust system resources, leading to denial of service conditions.