CVE-2026-76403: splunk connect_for_kafka Improper Certificate Validation

Vulnerability summary

CVE-2026-76403 is a high (CVSS 7.4) Improper Certificate Validation vulnerability in splunk connect_for_kafka. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.5% of scored vulnerabilities.

Timeline

1. 19-08-2026
   PublishedVulnerability first disclosed.
2. 20-08-2026
   Last modifiedVulnerability information updated.

Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate validation options when it builds the HTTP client. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Security configurations for Splunk Connect for Kafka (https://help.splunk.com/en/splunk-enterprise/get-data-in/splunk-connect-for-kafka/2.2/configure/security-configurations-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.