Start for Free
MEDIUM 5.3 Maven

Apache Kafka exposes sensitive information in its DEBUG logs

GHSA-wf66-mphr-4c4r · BIT-kafka-2026-33558 · CVE-2026-33558

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Information exposure vulnerability has been identified in Apache Kafka.

The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are:

  • AlterConfigsRequest

  • AlterUserScramCredentialsRequest

  • ExpireDelegationTokenRequest

  • IncrementalAlterConfigsRequest

  • RenewDelegationTokenRequest

  • SaslAuthenticateRequest

  • createDelegationTokenResponse

  • describeDelegationTokenResponse

  • SaslAuthenticateResponse

This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. Apache advises Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.

References

More Maven vulnerabilities

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes