CVE-2026-33558

Description

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — Exploit Prediction

0.0014

Probability of exploitation

0.34%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-533 CWE-533

Affected Products

Vendor	Product	Versions
apache	kafka	0.11.0.0 — 3.9.2
apache	kafka	All
apache	kafka	All
apache	kafka	All
apache	kafka	All

References

Advisories & Patches

https://kafka.apache.org/cve-list https://lists.apache.org/thread/pz5g4ky3h0k91tfd14p0dzqjp80960kl

Other References

http://www.openwall.com/lists/oss-security/2026/04/17/3

Frequently Asked Questions

What is CVE-2026-33558? +

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2026-33558? +

CVE-2026-33558 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0014, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-33558? +

CVE-2026-33558 affects products from apache, specifically: kafka. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-33558? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-33453 10.0

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap component is vulnerable to …

CVE-2026-42812 9.9

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table …

CVE-2026-42809 9.9

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been …

CVE-2026-42811 9.9

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but …

CVE-2024-23538 9.9

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: …

CVE-2024-45387 9.9

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with …