CVE-2026-76401
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit.
Risk Assessment
An attacker can cause event delivery to stop for a connector, potentially leading to data processing interruptions and affecting service availability.
Recommendation
It is recommended to update Splunk Connect for Kafka to version 2.2.7 or later, which includes the fix.
Other vulnerabilities in Splunk Connect for Kafka
See all- CVE-2026-76403High
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with HTTP Event Collector in Splunk Enterprise. The vulnerability exists because the Kerberos authentication path does not apply the configured certificate validation options when building the HTTP client.
- CVE-2026-76402High
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure a non-secure HTTP Event Collector endpoint in Splunk Enterprise, causing the connector to send authentication credentials to an attacker-controlled server. This could lead to credential exposure and compromise of data sent through the connector.
- CVE-2026-76400Medium
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API and influence responses from an HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit.
Original NVD description (English source)
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka) and Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka) in the Splunk documentation.