CVE-2026-76400: Splunk Connect for Kafka DoS Vulnerability

CVE-2026-76400 Overview

CVE-2026-76400 affects Splunk Connect for Kafka versions below 2.2.7. An unauthenticated attacker who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector (HEC) endpoint in Splunk Enterprise can trigger a denial-of-service condition. The connector retries failed event batches using an unbounded default rather than a finite retry limit. Continuous retries stall event delivery through the connector. The issue is categorized under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
An unauthenticated attacker capable of reaching the Kafka Connect REST API and influencing HEC responses can halt event delivery from Splunk Connect for Kafka, disrupting downstream logging and detection pipelines.

Affected Products

Splunk Connect for Kafka versions below 2.2.7
Deployments exposing the Kafka Connect REST API to untrusted networks
Splunk Enterprise environments ingesting data through HEC via the connector

Discovery Timeline

2026-08-19 - CVE-2026-76400 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76400

Vulnerability Analysis

Splunk Connect for Kafka forwards event batches from Apache Kafka topics into Splunk Enterprise using the HTTP Event Collector. The connector must handle transient HEC failures such as timeouts, throttling, or malformed responses. In versions below 2.2.7, the retry handler for failed batches defaults to an unbounded retry count.

When an attacker influences HEC responses to appear as persistent failures, the connector never abandons the offending batch. The worker thread remains occupied replaying the same event batch indefinitely. Event delivery through the affected task stops, and backpressure accumulates in Kafka topics.

The attack does not require authentication to Splunk Connect for Kafka itself. The prerequisites are network reachability to the Kafka Connect REST API and the ability to manipulate HEC endpoint responses observed by the connector.

Root Cause

The root cause is an unsafe default configuration in HEC delivery retry handling. The connector ships with an unbounded retry value for failed batches instead of enforcing a finite maximum. This satisfies [CWE-400] because a remote actor can consume connector processing capacity indefinitely by keeping a single batch in the retry loop.

Attack Vector

The vulnerability is exploited over the network. An attacker must reach the Kafka Connect REST API and influence responses returned from the HEC endpoint that the connector targets. This may occur when the REST API is exposed beyond trusted management networks or when a network position permits response manipulation. Successful exploitation halts event delivery without affecting confidentiality or integrity.

No verified public proof-of-concept code is available. Refer to the Splunk Security Advisory SVD-2026-0808 for vendor-provided technical details.

Detection Methods for CVE-2026-76400

Indicators of Compromise

Repeated HEC delivery failure entries in Splunk Connect for Kafka logs referencing the same batch or offset range
Kafka consumer lag growing continuously on topics served by the connector while the task remains in a RUNNING state
Sustained non-2xx HTTP responses from the configured HEC endpoint correlated with stalled event throughput

Detection Strategies

Monitor Kafka Connect task metrics for sink-record-send-rate dropping to zero while sink-record-active-count remains elevated
Alert on unauthenticated or unexpected client access to the Kafka Connect REST API from outside management subnets
Correlate HEC endpoint response codes with connector retry log messages to identify influenced or spoofed responses

Monitoring Recommendations

Ingest Kafka Connect worker logs into the security data lake and baseline normal retry frequency per task
Track HEC ingestion volume per source; sustained flatlines from a Kafka source indicate delivery stoppage
Enable network flow logging for the Kafka Connect REST API port to detect exposure or unexpected callers

How to Mitigate CVE-2026-76400

Immediate Actions Required

Upgrade Splunk Connect for Kafka to version 2.2.7 or later
Restrict access to the Kafka Connect REST API using network segmentation, firewall rules, and authenticated reverse proxies
Verify that the HEC endpoint URL configured in the connector is reachable only through trusted network paths
Review connector logs for signs of prolonged retry loops predating the upgrade

Patch Information

Splunk resolved the issue in Splunk Connect for Kafka 2.2.7 by enforcing a finite retry limit for failed HEC batches. Consult the Splunk Security Advisory SVD-2026-0808 for the authoritative fix details and the Install Splunk Connect for Kafka guide for upgrade procedures.

Workarounds

Configure a finite maximum retry value in the connector configuration where supported, per the Data ingestion parameters documentation
Place the Kafka Connect REST API behind mutual TLS or a bastion host to prevent unauthenticated reachability
Isolate the HEC endpoint on a dedicated network segment to reduce the risk of response manipulation
Implement health checks that restart stalled connector tasks after a defined delivery inactivity threshold

bash

# Configuration example: enforce a finite retry ceiling in the connector properties
# Refer to the Splunk documentation linked above for supported parameter names
max.retries=5
retry.backoff.ms=1000