CVE-2026-33558: Apache Kafka Information Exposure Through Network Client Log Output
Summary
CVE-2026-33558: Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output. Affects kafka across 2 version ranges.
>= 0.11.0, < 3.9.2
>= 4.0.0, < 4.0.1
Fixed in 3.9.2 or 4.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- org.apache.kafka:kafka-clients · Maven
The same CVE-2026-33558 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is an open-source distributed event streaming platform capable of handling trillions of events a day. It is designed for high-throughput, fault-tolerant, and scalable messaging. Kafka clients are used to interact with Kafka brokers, enabling the production and consumption of messages. However, a vulnerability has been identified that can expose sensitive information through network client log outputs when the DEBUG log level is enabled.
Vulnerability Detail
The vulnerability arises from the NetworkClient component of Apache Kafka, which outputs entire request and response information at the DEBUG log level. If DEBUG logging is enabled, sensitive data from requests and responses can be exposed in the logs. This includes information from several requests such as AlterConfigsRequest, AlterUserScramCredentialsRequest, and SaslAuthenticateRequest, among others. The exposure of this information can lead to unauthorized access or misuse of sensitive data, posing a significant security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.11.0, < 3.9.23.9.2 -
>= 4.0.0, < 4.0.14.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should avoid enabling DEBUG log level in their Kafka configurations to prevent sensitive information from being logged. This can be done by ensuring that the logging level is set to INFO or higher in the logging configuration file.
Conclusion
In summary, CVE-2026-33558 poses a significant risk to Apache Kafka users by potentially exposing sensitive information through network client logs. Users are advised to upgrade to the latest patched versions to mitigate this vulnerability and to avoid enabling DEBUG logging in the meantime.
See every vulnerability recorded for kafka →
FAQ
CVE-2026-33558 is a vulnerability in Apache Kafka that allows sensitive information to be exposed through network client log outputs when DEBUG logging is enabled.
The vulnerability affects all versions of Apache Kafka that support the listed API requests up to v3.9.1 and v4.0.0.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
If an immediate upgrade is not possible, ensure that DEBUG logging is disabled to prevent sensitive information from being logged.
More information can be found in the official Apache Kafka documentation and the CVE database listing for CVE-2026-33558.
Related vulnerabilities
Recent vulnerabilities recorded for kafka.
