Confluent Kafka Python Improper TLS Certificate Validation

published 2026-10-01 38 d ago modified 2026-10-06 34 d ago also EUVD-2026-91008

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.

Patch / fix

distros 1 links 1

python-confluent-kafka openSUSE Tumbleweed 2.15.1-1.1

opensuse advisories openSUSE-SU-2026:12006-1

support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-1… advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-15911 updated 2026-10-16 cvss 7.4

confluent-kafka: confluent-kafka: Information disclosure via improper TLS certificate validation in HashiCorp Vault integration

Red Hat Satellite 6 satellite/iop-puptoo-rhel9, satellite/iop-yuptoo-rhel9, satellite/iop-host-inventory-rhel9, satellite/iop-advisor-backend-rhel9, satellite/iop-insights-engine-rhel9
affected: workaround, no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 34 d ago (2026-10-06)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

confluent confluent-kafka

Classification

Weakness

CWE-295 Improper Certificate Validation

References

support.confluent.io /hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TL
vendor-advisory, patch

Sources

CVE List CVE-2026-15911
NVD CVE-2026-15911

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary