Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.kafka:connect-runtime

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
4.4.0 (Oct 14, 2026): no advisory affects it
Newest unaffected release
4.4.0 (Oct 14, 2026), the latest release
Advisories
2 · 2 high
Dependents
6
Releases
83 since 0.9.0.0 (Nov 21, 2015)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-116593
    Affects 2.4.0 to 4.2.1 (4.2.2 is outside it); 4.3.0 to 4.3.1 (4.3.2 is outside it)
  • CVE-2026-115644
    Affects 2.4.0 to 4.2.1 (4.2.2 is outside it); 4.3.0 to 4.3.1 (4.3.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

    Affected: from 2.4.0, fixed in 4.2.2; from 4.3.0, fixed in 4.3.2.

    Fixed in 4.2.2 (released Sep 22, 2026, 36 days before disclosure) and 4.3.2 (released Oct 21, 2026, 7 days before disclosure).

    The latest release, 4.4.0, is not affected.

  • Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

    Affected: from 2.4.0, fixed in 4.2.2; from 4.3.0, fixed in 4.3.2.

    Fixed in 4.2.2 (released Sep 22, 2026, 36 days before disclosure) and 4.3.2 (released Oct 21, 2026, 7 days before disclosure).

    The latest release, 4.4.0, is not affected.