Improper Certificate Validation Affecting confluent-kafka package, versions [,2.15.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-CONFLUENTKAFKA-20417141
- published4 Oct 2026
- disclosed1 Oct 2026
- creditRahul Karne
Introduced: 1 Oct 2026
NewCVE-2026-15911 (opens in a new tab)How to fix?
Upgrade confluent-kafka to version 2.15.0 or higher.
Overview
confluent-kafka is a high-level Producer, Consumer and AdminClient compatible with all Apache KafkaTM broker
Affected versions of this package are vulnerable to Improper Certificate Validation in HcVaultKmsClient.__init__ in src/confluent_kafka/schema_registry/rules/encryption/hcvault/hcvault_client.py, which constructs its hvac.Client with a literal verify=False and accepts no parameter through which a caller could override it. An attacker in a MitM position between the client and the Vault server can impersonate Vault, capture the token or AppRole credentials the client presents, and manipulate key wrap and unwrap operations, by presenting any certificate at all, since none is checked. This requires network position on the path to Vault and an application using the Vault KMS provider for Schema Registry client side field level encryption, and the defect is confined to that connection rather than the client's Kafka or Schema Registry connections.