The Python client library for Confluent Kafka integrates with HashiCorp Vault KMS but historically enabled TLS certificate verification by default while still providing an option to override root certificates. The flaw allows a remote attacker to supply an invalid or self‑signed certificate and have the client accept it without verification, exposing an attacker to intercept or modify all traffic between the client and the Vault KMS. This results in confidential information such as secrets or credentials being compromised. The weakness is identified as CWE‑295, improper certificate validation.

Python applications that use the confluent‑kafka client library version 2.14.2 or earlier are vulnerable. The issue does not affect Confluent Platform server components or Confluent Cloud services. Only clients that configure the Vault KMS integration are impacted.

The CVSS score of 7.4 indicates high impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the nature of TLS certificate validation makes it trivial for an attacker that can control the communication endpoint to exploit the flaw. Because verification is disabled by default, a malicious server can be presented without the client performing any checks, leading to potential data leakage. No additional access or privilege escalation is required beyond establishing the network connection.