AIKIDO-2026-235792
confluent-kafka is vulnerable to Improper Certificate Validation
45
Medium Risk
This Affects:
confluent-kafkaTL;DR
The HashiCorp Vault KMS driver used by Schema Registry Client-Side Field Level Encryption builds its hvac.Client with TLS certificate verification disabled. The HcVaultKmsClient hard-coded verify=False, so connections to Vault never validated the server certificate, and a later _get_verify change still treated an empty ssl.ca.location / VAULT_CACERT value as verification off. A network attacker able to intercept traffic to Vault could impersonate the server, capture the Vault token, and read or tamper with wrapped key-encryption-key material. The fix wires a computed verify (defaulting to True) and optional client cert into hvac.Client and treats empty CA values as unconfigured.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use the HashiCorp Vault KMS driver for Schema Registry encryption (CSFLE) rules.
Background info
confluent-kafka is vulnerable to Improper Certificate Validation in versions 2.6.2 - 2.14.2.
How to fix this
Upgrade the confluent-kafka library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.