Login Request a demo
Medium severity · published Apr 20, 2026
CVE-2026-33558
Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AK
Apache Kafka · Apache Software Foundation
0.11.0 through 3.9.1; 4.0.0 · source: vendor
AK
Apache Kafka Clients · Apache Software Foundation
0.11.0 through 3.9.1; 4.0.0 · source: vendor
KA
Kafka · Apache
0.11.0.0 before 3.9.2; 4.0.0; 4.0.0; 4.0.0; 4.0.0 · source: NVD
Affected product
AK
Apache Kafka
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33558
Vendor Advisory
https://kafka.apache.org/cve-list
Mitigation
https://lists.apache.org/thread/pz5g4ky3h0k91tfd14p0dzqjp80960kl
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/17/3
More from Apache Kafka
9.1
CVE-2026-33557
Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
5.3
CVE-2024-56128
Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
4.3
CVE-2026-41115
Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API