CVE-2026-76402

CVE-2026-76402 exposes a trust model inversion in Splunk Connect for Kafka that is more severe than a typical credential theft vulnerability. The Kafka Connect REST API, which controls where HEC credentials are routed, requires no authentication and is reachable to unauthenticated users. An attacker with network access to this API can redirect the HEC endpoint to an attacker-controlled server, silently exfiltrating the credentials themselves. This is not a misconfiguration—it is an architectural decision that treats the management plane (connector configuration) and the data plane (event forwarding) as separate security domains when they are functionally inseparable. The CVSS 8.2 rating warrants scrutiny. The attack requires network access to the REST API, which constrains scope, but the impact is severe: full HEC credential compromise. The qualifier 'limited alteration of event delivery' is doing significant work in the score. If this reflects code-level structural limitations (the original developers never built suppression capabilities), then the blast radius is partially contained—attackers can steal credentials but cannot fully corrupt the pipeline. If it reflects attacker choice to avoid detection, the blast radius extends to whatever those HEC credentials reach: SIEM data, security telemetry, business-critical audit logs. The distinction matters for incident response scope. The fix in version 2.2.7 adds transport validation (presumably HTTPS verification), but notably does not add authentication to the REST API itself. An attacker with network access can still redirect credentials to a valid HTTPS endpoint. This is a necessary fix but an insufficient one—it addresses the obvious exfiltration path without closing the underlying trust inversion. Detection is the harder problem. The unauthenticated REST API design implies legitimate operational use during normal configuration and troubleshooting. If configuration changes are routine operational events, there is no clean signal distinguishing an engineer modifying the HEC endpoint from an attacker redirecting credentials. The exploitation chain—REST API call to set an HTTP endpoint, followed by outbound HEC traffic to that endpoint—is technically detectable with network telemetry, but the window between configuration change and credential exfiltration could be seconds or days depending on event volume. Organizations without full packet capture, DNS logging, or REST API audit logs will have no forensic trace that exploitation occurred. The deeper pattern: Splunk's product lineage shows this is not a novel vulnerability class. The Splunk Add-on Builder shipped with similar unauthenticated configuration endpoints retrofitted with auth after discovery. This is the third iteration of the same architectural decision across Kafka Connect, Syslog-ng connectors, and the Add-on Builder ecosystem. The recurring pattern suggests institutional shortcut-taking with known precedent rather than accidental oversight. Priorities: First, confirm whether your Splunk Connect for Kafka deployment exposes the REST API to untrusted networks—this should be isolated to management segments. Second, implement logging and alerting on Kafka Connect REST API configuration changes, specifically HEC endpoint modifications, even if the baseline volume is high. Third, rotate HEC credentials immediately and treat them as potentially compromised—this is a lower-friction immediate action while longer-term network isolation is assessed. Fourth, audit Splunk's other connector products (Syslog, HTTP Event Collector integrations) for similar management-plane-to-data-plane trust assumptions.

Reviewed through automated stages and approved by a human before publication.