CVE-2026-76401 Splunk CVE debrief

Who should care

Splunk Connect for Kafka administrators, Kafka Connect users, and security teams responsible for monitoring and protecting data ingestion pipelines should be aware of this vulnerability and take steps to mitigate it. These stakeholders should review their current configurations, assess their exposure, and implement necessary controls to prevent exploitation. Additionally, security teams should monitor for suspicious activity and review relevant logs to detect potential attacks.

Technical summary

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability exists because timestamp extraction evaluates customer-supplied regular expressions without a time limit, allowing an attacker to craft a regular expression that consumes excessive resources and causes the worker thread to block. This issue can be mitigated by updating to version 2.2.7 or later, restricting access to the Kafka Connect REST API, and monitoring for suspicious activity.

Defensive priority

Medium-priority defensive actions are recommended due to the potential for denial of service via crafted regular expressions in Splunk Connect for Kafka versions below 2.2.7.

Recommended defensive actions

• Review and update Splunk Connect for Kafka to version 2.2.7 or later
• Implement network restrictions to limit access to the Kafka Connect REST API
• Monitor for suspicious regular expression configurations
• Consider implementing compensating controls such as Web Application Firewalls
• Inventory and assess exposure of affected connectors
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the NVD and Splunk advisory indicates that unauthenticated users can block Kafka Connect worker threads by configuring timestamp extraction with crafted regular expressions, affecting event delivery for the connector. The vulnerability exists because timestamp extraction evaluates customer-supplied regular expressions without a time limit.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.