An Apache Kafka principal that is authenticated but lacking any authorization grants can send an IncrementalAlterConfigs or AlterConfigs request targeting a BROKER resource. The broker processes the configuration validation before performing the authorization check, and during this phase it resolves configuration variables that reference files or environment variables using the ConfigProvider specified in the request. Because this resolution occurs before the newly added allowlist enforcement for config providers, the arbitrarily specified provider (e.g., FileConfigProvider or EnvVarConfigProvider) is instantiated and the target file or environment variable is read. A validation error then returns the resolved content back to the caller, allowing the principal to read broker‑host files or environment variables. The vulnerability is a CWE‑862 defect, indicating missing authorization checks for privileged operations.

The flaw exists in all released versions of Apache Kafka prior to the security updates included in 4.2.2, 4.3.2, and 4.4.0. The affected environment is a Kafka cluster that has an authorizer enabled; with an authorizer, a principal that has no ALTER_CONFIGS or other grant can exploit the vulnerability. Clusters running without an authorizer are effectively not impacted because such principals effectively hold ALTER_CONFIGS by default.

Because the vulnerability only discloses data and does not compromise the broker’s availability or integrity, its severity in terms of CVSS is not explicitly defined in the available data. However, any authenticated principal that can read arbitrary files or environment variables can expose sensitive credentials or keys, leading to credential compromise. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is an internal user or compromised service that is authenticated against the broker but has no explicit authorization grants. Exploitation requires that the attacker be able to dispatch a configuration change request, which is typically trivial for a normal user in a Kafka environment that relies on authorizers to enforce permissions.