CVE-2026-15911 (GCVE-0-2026-15911)

Vulnerability from cvelistv5 – Published: 2026-10-01 18:29 – Updated: 2026-10-01 18:29
VLAI
Title
Confluent Kafka Python Improper TLS Certificate Validation
Summary
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-295 - Improper certificate validation
Assigner
References
Impacted products
Vendor Product Version CPE status
confluent confluent-kafka Affected: 0 , ≤ 2.14.2 (semver)
    cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*
    cpe:2.3:a:confluent:confluent-kafka:2.14.2:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Rahul Karne
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*",
            "cpe:2.3:a:confluent:confluent-kafka:2.14.2:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "confluent-kafka",
          "vendor": "confluent",
          "versions": [
            {
              "lessThanOrEqual": "2.14.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.14.2",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Rahul Karne"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Confluent Kafka Python client\u0027s HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation."
            }
          ],
          "value": "Confluent Kafka Python client\u0027s HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper certificate validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T18:29:42.297Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\u003cli\u003e\u003cstrong\u003econfluent-kafka (Python): \u003c/strong\u003eThis issue has been addressed in confluent-kafka (Python) 2.15.0, which:\u003cul\u003e\u003cli\u003eEnables TLS certificate verification by default.\u003c/li\u003e\u003cli\u003eExposes configuration to supply a custom CA bundle and an optional client certificate for mutual TLS, through both driver configuration and standard Vault environment variables:\u003cul\u003e\u003cli\u003essl.ca.location (or environment variable VAULT_CACERT): CA bundle used to verify the Vault server certificate.\u003c/li\u003e\u003cli\u003essl.certificate.location (or environment variable VAULT_CLIENT_CERT): client certificate for mutual TLS.\u003c/li\u003e\u003cli\u003essl.key.location (or environment variable VAULT_CLIENT_KEY): client private key for mutual TLS.\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eAn empty or unset CA value keeps verification enabled; it does not silently disable verification.\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eConfluent Platform: \u003c/strong\u003eNot affected. The vulnerability resides in the confluent-kafka Python client library and does not affect Confluent Platform server components or their released versions.\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eConfluent Cloud:\u003c/strong\u003e Not affected. No remediation is required for Confluent Cloud.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "*  confluent-kafka (Python): This issue has been addressed in confluent-kafka (Python) 2.15.0, which:  *  Enables TLS certificate verification by default.\n  *  Exposes configuration to supply a custom CA bundle and an optional client certificate for mutual TLS, through both driver configuration and standard Vault environment variables:  *  ssl.ca.location (or environment variable VAULT_CACERT): CA bundle used to verify the Vault server certificate.\n  *  ssl.certificate.location (or environment variable VAULT_CLIENT_CERT): client certificate for mutual TLS.\n  *  ssl.key.location (or environment variable VAULT_CLIENT_KEY): client private key for mutual TLS.\n\n\n\n  *  An empty or unset CA value keeps verification enabled; it does not silently disable verification.\n\n\n\n  *  Confluent Platform: Not affected. The vulnerability resides in the confluent-kafka Python client library and does not affect Confluent Platform server components or their released versions.\n  *  Confluent Cloud: Not affected. No remediation is required for Confluent Cloud."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Confluent Kafka Python Improper TLS Certificate Validation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-15911",
    "datePublished": "2026-10-01T18:29:42.297Z",
    "dateReserved": "2026-07-15T19:28:12.162Z",
    "dateUpdated": "2026-10-01T18:29:42.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*",
                  "cpe:2.3:a:confluent:confluent-kafka:2.14.2:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "confluent-kafka",
                "vendor": "confluent",
                "versions": [
                  {
                    "lessThanOrEqual": "2.14.2",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@us.ibm.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Confluent Kafka Python client\u0027s HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation."
          }
        ],
        "id": "CVE-2026-15911",
        "lastModified": "2026-10-01T20:36:15.187",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.2,
              "source": "psirt@us.ibm.com",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-10-01T19:17:19.947",
        "references": [
          {
            "source": "psirt@us.ibm.com",
            "url": "https://support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration"
          }
        ],
        "sourceIdentifier": "psirt@us.ibm.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "psirt@us.ibm.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-02T01:03:41+00:00",
      "cve": "CVE-2026-15911",
      "id": "CVE-2026-15911",
      "initial_release_date": "2026-10-01T18:29:42.297000+00:00",
      "product_status:known_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "confluent-kafka: confluent-kafka: Information disclosure via improper TLS certificate validation in HashiCorp Vault integration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15911.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.