CVE-2026-76403
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with HTTP Event Collector in Splunk Enterprise. The vulnerability exists because the Kerberos authentication path does not apply the configured certificate validation options when building the HTTP client.
Risk Assessment
An attacker could intercept or modify data sent to Splunk, potentially leading to data confidentiality and integrity compromise.
Recommendation
Update Splunk Connect for Kafka to version 2.2.7 or later and ensure certificate validation is properly configured.
Other vulnerabilities in Splunk Connect for Kafka
See all- CVE-2026-76402High
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure a non-secure HTTP Event Collector endpoint in Splunk Enterprise, causing the connector to send authentication credentials to an attacker-controlled server. This could lead to credential exposure and compromise of data sent through the connector.
- CVE-2026-76401Medium
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit.
- CVE-2026-76400Medium
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API and influence responses from an HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit.
Original NVD description (English source)
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate validation options when it builds the HTTP client. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Security configurations for Splunk Connect for Kafka (https://help.splunk.com/en/splunk-enterprise/get-data-in/splunk-connect-for-kafka/2.2/configure/security-configurations-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.