High severity · published Jan 14, 2020
CVE-2019-12399
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on…
7.5
CVSS
3.9%
EPSS
No
On KEV
Description
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Banking Corporate Lending Process Management · Oracle
14.1.0; 14.3.0; 14.4.0 · source: NVD
BC
Banking Credit Facilities Process Management · Oracle
14.1.0; 14.3.0; 14.4.0 · source: NVD
BL
Banking Liquidity Management · Oracle
14.0.0 through 14.4.0 · source: NVD
BP
Banking Payments · Oracle
14.4.0 · source: NVD
BP
Banking Platform · Oracle
2.7.0 · source: NVD
BS
Banking Supply Chain Finance · Oracle
14.2.0 through 14.4.0 · source: NVD
BT
Banking Trade Finance Process Management · Oracle
14.1.0; 14.3.0; 14.4.0 · source: NVD
BV
Banking Virtual Account Management · Oracle
14.1.0; 14.3.0; 14.4.0 · source: NVD
BP
Blockchain Platform · Oracle
before 21.1.2 · source: NVD
CC
Communications Cloud Native Core Policy · Oracle
1.9.0 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.6 through 8.1.0 · source: NVD
FU
Flexcube Universal Banking · Oracle
14.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12399
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12399
Mailing List
http://www.openwall.com/lists/oss-security/2020/01/14/1
lists.apache.org
https://lists.apache.org/thread.html/r0e3a613705d70950aca2bfe9a6265c87503921852d9a3dbce512ca9f%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r2d390dec5f360ec8aa294bef18e1a4385e2a3698d747209216f5a48b%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r3154f5adbc905f1f9012a92240c8e00a96628470cc819453b9606d0e%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r3203d7f25a6ca56ff3e48c43a6aa7cb60b8e5d57d0eed9f76dc2b7a8%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r47c225db363d1ee2c18c4b3b2f51b63a9789f78c7fa602e5976ecd05%40%3Ccommits.druid.apache.org%3E
More from Kafka
9.1
CVE-2026-33557
Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
8.8
CVE-2025-27818
A possible security vulnerability has been identified in Apache Kafka
8.8
CVE-2018-17196
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation
8.7
CVE-2026-35554
Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
7.5
CVE-2025-27819
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API