Vulnerability in Apache Kafka
CVE-2026-33558
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: * AlterConfigsRequest * AlterUserScramCredentialsRequest * ExpireDelegationTokenRequest * IncrementalAlterConfigsRequest * RenewDelegationTokenRequest * SaslAuthenticateRequest * createDelegationTokenResponse * describeDelegationTokenResponse * SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
EPSS: 0.006 (47.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Apache Kafka — versions 4.0.0
- Apache Software Foundation Kafka — versions 0.11.0, 4.0.0
- Apache Software Foundation Kafka Clients — versions 0.11.0, 4.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Vendor Advisory)
- security@apache.org (Vendor Advisory, mailing-list, Mitigation)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
Frequently asked questions
- What is CVE-2026-33558?
- CVE-2026-33558 is a medium-severity vulnerability in Apache Kafka, classified under CWE-533. CVSS score: 5.3/10. Published 2026-04-20.
- How severe is CVE-2026-33558?
- Medium severity. CVSS v3 base score is 5.3 out of 10.