Apache Kafka Connect's REST API includes a /connector-plugins/{connector-type}/config/validate endpoint that validates connector configurations. This endpoint can be exploited by an attacker with access to resolve and retrieve plaintext sensitive configuration values via any installed configuration providers. The issue is fixed in versions 4.2.2, 4.3.2, 4.4.0 and later.