Apache Kafka exposes sensitive information in its DEBUG logs
Medium5.3CVE-2026-33558 · Published Apr 20, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kafka:kafka-clients Maven | >= 0.11.0, < 3.9.2 | 3.9.2 |
| >= 4.0.0, < 4.0.1 | 4.0.1 |
Details and references
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. Apache advises Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-532
- Also known as
- BIT-kafka-2026-33558, CVE-2026-33558
More Apache Kafka advisories
All Apache Kafka| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 20 | Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation CVE-2026-33557Critical9.1fixed in 4.1.2 | Critical9.1 | 4.1.2 |
| Apr 7 | Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition CVE-2026-35554High8.7fixed in 3.9.2, 4.0.2, 4.1.2 | High8.7 | 3.9.2, 4.0.2, 4.1.2 |
| Jun 102025 | Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability CVE-2025-27817Medium7.5fixed in 3.9.1 | Medium7.5 | 3.9.1 |
| Jun 102025 | Apache Kafka Deserialization of Untrusted Data vulnerability CVE-2025-27818High8.8fixed in 3.9.1 | High8.8 | 3.9.1 |
| Jun 102025 | Apache Kafka Deserialization of Untrusted Data vulnerability CVE-2025-27819High8.8fixed in 3.4.0 | High8.8 | 3.4.0 |
| Dec 182024 | Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm CVE-2024-56128Low5.3fixed in 3.7.2, 3.8.1 | Low5.3 | 3.7.2, 3.8.1 |