CVE-2025-30677 json
Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors
published 2025-04-09 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-10663 , GHSA-rcqj-3fmp-5cqx
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs.
This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue.
This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4.
3.0.x version users should upgrade to at least 3.0.11.
3.3.x version users should upgrade to at least 3.3.6.
4.0.x version users should upgrade to at least 4.0.4.
Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
Patch / fix
- maven org.apache.pulsar:pulsar-io-kafka-connect-adaptor 3.0.11, 3.3.6, 4.0.4
- maven org.apache.pulsar:pulsar-io-kafka 3.0.11, 3.3.6, 4.0.4
- Apache Software Foundation Apache Pulsar IO Kafka Connector 3.0.11, 3.3.6, 4.0.4
- Apache Software Foundation Apache Pulsar IO Kafka Connect Adaptor 3.0.11, 3.3.6, 4.0.4
- github.com/apache/pulsar#24128 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.74% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.pulsar:pulsar-io-kafka-connect-adaptor | <3.0.11 >=3.3.0, <3.3.6 >=4.0.0, <4.0.4 |
3.0.11 3.3.6 4.0.4 |
| maven | org.apache.pulsar:pulsar-io-kafka | <3.0.11 >=3.3.0, <3.3.6 >=4.0.0, <4.0.4 |
3.0.11 3.3.6 4.0.4 |
Affected products
- Apache Software Foundation Apache Pulsar IO Kafka Connector
- Apache Software Foundation Apache Pulsar IO Kafka Connect Adaptor
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
github.com
/apache/pulsar/pull/24128
web
-
lists.apache.org
/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3d
vendor-advisory, web, mailing-list
-
pulsar.apache.org
/security/
vendor-advisory
-
openwall.com
/lists/oss-security/2025/04/09/2
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-30677
advisory
-
github.com
/apache/pulsar
package
-
pulsar.apache.org
/security
web
Sources
- CVE List CVE-2025-30677
- GitHub Advisory GHSA-rcqj-3fmp-5cqx
- NVD CVE-2025-30677
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.