CVE-2026-33558: Apache Kafka kafka-clients Exposes Sensitive Information in DEBUG Logs
Summary
CVE-2026-33558: Apache Kafka exposes sensitive information in its DEBUG logs. Affects org.apache.kafka:kafka-clients across 2 version ranges.
>= 0.11.0, < 3.9.2
>= 4.0.0, < 4.0.1
Fixed in 3.9.2 or 4.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- kafka · Bitnami
The same CVE-2026-33558 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is a distributed event streaming platform capable of handling trillions of events a day. It is widely used for building real-time data pipelines and streaming applications. The kafka-clients library is a core component that allows applications to interact with Kafka clusters. However, it has been found to expose sensitive information when DEBUG logging is enabled, which can lead to serious security risks.
Vulnerability Detail
The vulnerability stems from the NetworkClient component of Apache Kafka, which outputs entire request and response information at the DEBUG log level. If DEBUG logging is enabled, sensitive data can be exposed, including details from requests such as AlterConfigsRequest and SaslAuthenticateRequest. This information exposure can lead to unauthorized access and data breaches, making it critical for users to manage their logging levels appropriately.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.11.0, < 3.9.23.9.2 -
>= 4.0.0, < 4.0.14.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should avoid enabling DEBUG logging in production environments to prevent sensitive information from being logged. It is advisable to keep the log level at INFO or lower until the upgrade can be performed.
Conclusion
The information exposure vulnerability in Apache Kafka's kafka-clients library poses a significant risk if DEBUG logging is enabled. Users are strongly advised to upgrade to the latest patched versions to safeguard sensitive information and maintain the security of their applications.
See every vulnerability recorded for org.apache.kafka:kafka-clients →
FAQ
CVE-2026-33558 is a vulnerability in Apache Kafka that exposes sensitive information in DEBUG logs when certain requests and responses are logged.
The vulnerability affects all versions of Apache Kafka from the introduction of the listed API through v3.9.1 and v4.0.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your pom.xml. You can also check your application using the Vulert playground without signup.
If an immediate upgrade is not possible, ensure that DEBUG logging is disabled in your production environment to mitigate the risk of sensitive data exposure.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka-clients.
