{"id":"CVE-2026-15911","aliases":["EUVD-2026-91008","GHSA-r743-crv8-m3qr","openSUSE-SU-2026:12006-1"],"status":"published","title":"Confluent Kafka Python Improper TLS Certificate Validation","description":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00297,"percentile":0.22607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-295"],"published":"2026-10-01T18:29:42Z","modified":"2026-10-06T02:17:04Z","exploits":[{"source":"pocgithub","id":"rahulreddykarne/CVE-2026-15911-Confluent_Kafka","title":"rahulreddykarne/CVE-2026-15911-Confluent_Kafka","date":"2026-09-26","url":"https://github.com/rahulreddykarne/CVE-2026-15911-Confluent_Kafka"}],"fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"python-confluent-kafka","fixed_in":["2.15.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-confluent-kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1-1.1"}]}]}],"products":[{"vendor":"confluent","product":"confluent-kafka"}],"references":[{"url":"https://support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15911"},{"url":"https://github.com/advisories/GHSA-r743-crv8-m3qr"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15911","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-15911","title":"Confluent Kafka Python Improper TLS Certificate Validation","description":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.","status":"published","published":"2026-10-01T18:29:42.297Z","modified":"2026-10-06T02:01:13.972Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-91008","description":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.","status":"published","published":"2026-10-01T18:29:42Z","modified":"2026-10-06T02:01:13Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:39.05741Z"}],"ghsa":[{"id":"GHSA-r743-crv8-m3qr","title":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to...","description":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.","status":"published","published":"2026-10-01T21:32:50Z","modified":"2026-10-01T21:33:03Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:12:41.196374Z"}],"nvd":[{"id":"CVE-2026-15911","description":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.","status":"published","published":"2026-10-01T19:17:19.947Z","modified":"2026-10-06T02:17:04.96Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:53.41762Z"}],"osv":[{"id":"openSUSE-SU-2026:12006-1","title":"python313-confluent-kafka-2.15.1-1.1 on GA media","description":"These are all security issues fixed in the python313-confluent-kafka-2.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:46.42380104Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}