Search
Find a vulnerability
Search criteria
6 vulnerabilities by confluent
CVE-2026-15911 (GCVE-0-2026-15911)
Vulnerability from nvd – Published: 2026-10-01 18:29 – Updated: 2026-10-01 18:29
VLAI
EPSS
VEX
Title
Confluent Kafka Python Improper TLS Certificate Validation
Summary
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.
Severity
7.4 (High)
CWE
- CWE-295 - Improper certificate validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.confluent.io/hc/en-us/articles/54… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| confluent | confluent-kafka |
Affected:
0 , ≤ 2.14.2
(semver)
cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:* cpe:2.3:a:confluent:confluent-kafka:2.14.2:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*",
"cpe:2.3:a:confluent:confluent-kafka:2.14.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "confluent-kafka",
"vendor": "confluent",
"versions": [
{
"lessThanOrEqual": "2.14.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.14.2",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rahul Karne"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Confluent Kafka Python client\u0027s HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation."
}
],
"value": "Confluent Kafka Python client\u0027s HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:29:42.297Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003e\u003cstrong\u003econfluent-kafka (Python): \u003c/strong\u003eThis issue has been addressed in confluent-kafka (Python) 2.15.0, which:\u003cul\u003e\u003cli\u003eEnables TLS certificate verification by default.\u003c/li\u003e\u003cli\u003eExposes configuration to supply a custom CA bundle and an optional client certificate for mutual TLS, through both driver configuration and standard Vault environment variables:\u003cul\u003e\u003cli\u003essl.ca.location (or environment variable VAULT_CACERT): CA bundle used to verify the Vault server certificate.\u003c/li\u003e\u003cli\u003essl.certificate.location (or environment variable VAULT_CLIENT_CERT): client certificate for mutual TLS.\u003c/li\u003e\u003cli\u003essl.key.location (or environment variable VAULT_CLIENT_KEY): client private key for mutual TLS.\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eAn empty or unset CA value keeps verification enabled; it does not silently disable verification.\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eConfluent Platform: \u003c/strong\u003eNot affected. The vulnerability resides in the confluent-kafka Python client library and does not affect Confluent Platform server components or their released versions.\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eConfluent Cloud:\u003c/strong\u003e Not affected. No remediation is required for Confluent Cloud.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* confluent-kafka (Python): This issue has been addressed in confluent-kafka (Python) 2.15.0, which: * Enables TLS certificate verification by default.\n * Exposes configuration to supply a custom CA bundle and an optional client certificate for mutual TLS, through both driver configuration and standard Vault environment variables: * ssl.ca.location (or environment variable VAULT_CACERT): CA bundle used to verify the Vault server certificate.\n * ssl.certificate.location (or environment variable VAULT_CLIENT_CERT): client certificate for mutual TLS.\n * ssl.key.location (or environment variable VAULT_CLIENT_KEY): client private key for mutual TLS.\n\n\n\n * An empty or unset CA value keeps verification enabled; it does not silently disable verification.\n\n\n\n * Confluent Platform: Not affected. The vulnerability resides in the confluent-kafka Python client library and does not affect Confluent Platform server components or their released versions.\n * Confluent Cloud: Not affected. No remediation is required for Confluent Cloud."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Confluent Kafka Python Improper TLS Certificate Validation",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-15911",
"datePublished": "2026-10-01T18:29:42.297Z",
"dateReserved": "2026-07-15T19:28:12.162Z",
"dateUpdated": "2026-10-01T18:29:42.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-33924 (GCVE-0-2021-33924)
Vulnerability from nvd – Published: 2021-09-29 09:44 – Updated: 2024-08-04 00:05
VLAI
EPSS
VEX
Summary
Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.detack.de/en/cve-2021-33924 | x_refsource_MISC |
| https://confluent.io | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:05:52.234Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.detack.de/en/cve-2021-33924"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://confluent.io"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-29T10:51:19.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.detack.de/en/cve-2021-33924"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://confluent.io"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33924",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.detack.de/en/cve-2021-33924",
"refsource": "MISC",
"url": "https://www.detack.de/en/cve-2021-33924"
},
{
"name": "https://confluent.io",
"refsource": "MISC",
"url": "https://confluent.io"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33924",
"datePublished": "2021-09-29T09:44:26.000Z",
"dateReserved": "2021-06-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T00:05:52.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33923 (GCVE-0-2021-33923)
Vulnerability from nvd – Published: 2021-09-29 09:44 – Updated: 2024-08-04 00:05
VLAI
EPSS
VEX
Summary
Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database).
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.detack.de/en/cve-2021-33923 | x_refsource_MISC |
| https://confluent.io | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:05:52.054Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.detack.de/en/cve-2021-33923"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://confluent.io"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-29T10:50:52.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.detack.de/en/cve-2021-33923"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://confluent.io"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33923",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.detack.de/en/cve-2021-33923",
"refsource": "MISC",
"url": "https://www.detack.de/en/cve-2021-33923"
},
{
"name": "https://confluent.io",
"refsource": "MISC",
"url": "https://confluent.io"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33923",
"datePublished": "2021-09-29T09:44:19.000Z",
"dateReserved": "2021-06-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T00:05:52.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-15911 (GCVE-0-2026-15911)
Vulnerability from cvelistv5 – Published: 2026-10-01 18:29 – Updated: 2026-10-01 18:29
VLAI
EPSS
VEX
Title
Confluent Kafka Python Improper TLS Certificate Validation
Summary
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.
Severity
7.4 (High)
CWE
- CWE-295 - Improper certificate validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.confluent.io/hc/en-us/articles/54… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| confluent | confluent-kafka |
Affected:
0 , ≤ 2.14.2
(semver)
cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:* cpe:2.3:a:confluent:confluent-kafka:2.14.2:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*",
"cpe:2.3:a:confluent:confluent-kafka:2.14.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "confluent-kafka",
"vendor": "confluent",
"versions": [
{
"lessThanOrEqual": "2.14.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:confluent:confluent-kafka:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.14.2",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rahul Karne"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Confluent Kafka Python client\u0027s HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation."
}
],
"value": "Confluent Kafka Python client\u0027s HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:29:42.297Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003e\u003cstrong\u003econfluent-kafka (Python): \u003c/strong\u003eThis issue has been addressed in confluent-kafka (Python) 2.15.0, which:\u003cul\u003e\u003cli\u003eEnables TLS certificate verification by default.\u003c/li\u003e\u003cli\u003eExposes configuration to supply a custom CA bundle and an optional client certificate for mutual TLS, through both driver configuration and standard Vault environment variables:\u003cul\u003e\u003cli\u003essl.ca.location (or environment variable VAULT_CACERT): CA bundle used to verify the Vault server certificate.\u003c/li\u003e\u003cli\u003essl.certificate.location (or environment variable VAULT_CLIENT_CERT): client certificate for mutual TLS.\u003c/li\u003e\u003cli\u003essl.key.location (or environment variable VAULT_CLIENT_KEY): client private key for mutual TLS.\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eAn empty or unset CA value keeps verification enabled; it does not silently disable verification.\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eConfluent Platform: \u003c/strong\u003eNot affected. The vulnerability resides in the confluent-kafka Python client library and does not affect Confluent Platform server components or their released versions.\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eConfluent Cloud:\u003c/strong\u003e Not affected. No remediation is required for Confluent Cloud.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* confluent-kafka (Python): This issue has been addressed in confluent-kafka (Python) 2.15.0, which: * Enables TLS certificate verification by default.\n * Exposes configuration to supply a custom CA bundle and an optional client certificate for mutual TLS, through both driver configuration and standard Vault environment variables: * ssl.ca.location (or environment variable VAULT_CACERT): CA bundle used to verify the Vault server certificate.\n * ssl.certificate.location (or environment variable VAULT_CLIENT_CERT): client certificate for mutual TLS.\n * ssl.key.location (or environment variable VAULT_CLIENT_KEY): client private key for mutual TLS.\n\n\n\n * An empty or unset CA value keeps verification enabled; it does not silently disable verification.\n\n\n\n * Confluent Platform: Not affected. The vulnerability resides in the confluent-kafka Python client library and does not affect Confluent Platform server components or their released versions.\n * Confluent Cloud: Not affected. No remediation is required for Confluent Cloud."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Confluent Kafka Python Improper TLS Certificate Validation",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-15911",
"datePublished": "2026-10-01T18:29:42.297Z",
"dateReserved": "2026-07-15T19:28:12.162Z",
"dateUpdated": "2026-10-01T18:29:42.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-33924 (GCVE-0-2021-33924)
Vulnerability from cvelistv5 – Published: 2021-09-29 09:44 – Updated: 2024-08-04 00:05
VLAI
EPSS
VEX
Summary
Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.detack.de/en/cve-2021-33924 | x_refsource_MISC |
| https://confluent.io | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:05:52.234Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.detack.de/en/cve-2021-33924"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://confluent.io"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-29T10:51:19.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.detack.de/en/cve-2021-33924"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://confluent.io"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33924",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.detack.de/en/cve-2021-33924",
"refsource": "MISC",
"url": "https://www.detack.de/en/cve-2021-33924"
},
{
"name": "https://confluent.io",
"refsource": "MISC",
"url": "https://confluent.io"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33924",
"datePublished": "2021-09-29T09:44:26.000Z",
"dateReserved": "2021-06-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T00:05:52.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33923 (GCVE-0-2021-33923)
Vulnerability from cvelistv5 – Published: 2021-09-29 09:44 – Updated: 2024-08-04 00:05
VLAI
EPSS
VEX
Summary
Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database).
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.detack.de/en/cve-2021-33923 | x_refsource_MISC |
| https://confluent.io | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:05:52.054Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.detack.de/en/cve-2021-33923"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://confluent.io"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-29T10:50:52.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.detack.de/en/cve-2021-33923"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://confluent.io"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33923",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.detack.de/en/cve-2021-33923",
"refsource": "MISC",
"url": "https://www.detack.de/en/cve-2021-33923"
},
{
"name": "https://confluent.io",
"refsource": "MISC",
"url": "https://confluent.io"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33923",
"datePublished": "2021-09-29T09:44:19.000Z",
"dateReserved": "2021-06-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T00:05:52.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}