CVE-2026-76402: Splunk Connect for Kafka Disclosure Flaw

CVE-2026-76402 Overview

CVE-2026-76402 affects Splunk Connect for Kafka versions below 2.2.7. An unauthenticated attacker who can reach the Kafka Connect Representational State Transfer (REST) API can configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector (HEC) endpoint. The connector then transmits authentication credentials to an attacker-controlled server. This exposes credentials that compromise all data flowing through the connector and permits limited alteration of event delivery. The flaw stems from HEC endpoint validation that does not require secure transport by default. The issue maps to CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers reaching the Kafka Connect REST API can exfiltrate Splunk HEC tokens, compromising confidentiality of ingested telemetry and enabling manipulation of event delivery.

Affected Products

Splunk Connect for Kafka versions below 2.2.7
Deployments exposing the Kafka Connect REST API to untrusted networks
Splunk Enterprise environments receiving data from vulnerable connector instances

Discovery Timeline

2026-08-19 - CVE-2026-76402 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76402

Vulnerability Analysis

Splunk Connect for Kafka is a Kafka Connect sink connector that forwards Kafka topic data into Splunk Enterprise through the HTTP Event Collector. Configuration of connector instances occurs through the Kafka Connect REST API, which by default does not enforce authentication. When an attacker submits a connector configuration pointing splunk.hec.uri at an attacker-controlled server over plain HTTP, the connector forwards the configured HEC authentication token in the Authorization header of outbound requests. The absence of a mandatory HTTPS check permits credentials to leave the trust boundary in cleartext. Captured tokens allow the attacker to submit, replay, or drop events on behalf of the legitimate tenant.

Root Cause

The root cause is missing transport security validation on the HEC endpoint parameter. The connector accepts an http:// scheme without warning or rejection. Combined with an unauthenticated Kafka Connect REST API, any network-adjacent actor can register or update connector configurations that redirect authenticated traffic. This satisfies the SSRF pattern described in [CWE-918], where a server-side component is coerced into making requests to attacker-chosen destinations while presenting its own credentials.

Attack Vector

Exploitation requires network reach to the Kafka Connect REST API, typically on TCP port 8083. The attacker issues a POST or PUT to the /connectors endpoint with a JSON payload defining a Splunk sink whose splunk.hec.uri value points to attacker-controlled infrastructure over HTTP. Once the connector starts, the attacker's listener captures the HEC token from inbound requests. The attacker can then ingest fabricated events, suppress telemetry, or pivot within the Splunk environment using the stolen token.

No verified public exploit code has been released. See the Splunk Security Advisory SVD-2026-0808 for vendor technical details.

Detection Methods for CVE-2026-76402

Indicators of Compromise

Outbound HTTP (not HTTPS) requests from Kafka Connect worker hosts to unfamiliar external destinations containing an Authorization: Splunk header
Newly created or modified Kafka Connect connector configurations referencing an http:// scheme in splunk.hec.uri
Unexpected POST or PUT requests to /connectors or /connectors/{name}/config on Kafka Connect REST API endpoints from unauthorized sources

Detection Strategies

Audit all Kafka Connect connector configurations for any splunk.hec.uri value that does not begin with https://
Alert on Kafka Connect REST API traffic originating outside expected administrative subnets
Correlate HEC token usage in Splunk with the source IP addresses of ingest requests to identify tokens reaching from unexpected endpoints

Monitoring Recommendations

Enable access logging on the Kafka Connect REST API and forward logs to a centralized analytics platform for review
Monitor egress firewall telemetry for cleartext HTTP flows from Kafka Connect workers to non-approved destinations
Track HEC token issuance and rotation events in Splunk Enterprise for anomalies following suspected exposure

How to Mitigate CVE-2026-76402

Immediate Actions Required

Upgrade Splunk Connect for Kafka to version 2.2.7 or later
Restrict network access to the Kafka Connect REST API to trusted administrative hosts only
Rotate all HEC tokens that may have been exposed through vulnerable connector configurations
Review existing connector configurations and remove any that reference non-HTTPS HEC endpoints

Patch Information

Splunk has addressed this vulnerability in Splunk Connect for Kafka version 2.2.7. Refer to the Splunk Security Advisory SVD-2026-0808 for release notes and download links. Administrators should follow the vendor's Install Splunk Connect for Kafka documentation to complete the upgrade.

Workarounds

Place the Kafka Connect REST API behind a reverse proxy that enforces authentication and TLS
Bind the Kafka Connect REST listener to localhost or an internal management interface only
Enforce network segmentation so only sanctioned management hosts can reach TCP port 8083 on Kafka Connect workers
Configure HEC to accept tokens only from expected source IP ranges where feasible

bash

# Example: restrict Kafka Connect REST API listener in connect-distributed.properties
listeners=HTTP://127.0.0.1:8083
rest.advertised.host.name=127.0.0.1
rest.advertised.port=8083

# Enforce HTTPS-only HEC destinations at the network layer (iptables example)
iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner kafka -j REJECT