CVE intelligence and bounded remediation

CVE-2026-23529 — Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery

High CVSS 7.7

Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file read in Google BigQuery Sink connector. Aiven's Google BigQuery Kafka Connect Sink connector requires Google Cloud credential configurations for authentication to BigQuery services. During connector configuration, users can supply credential JSON files that are processed by Google authentication libraries. The service fails to validate externally-sourced credential configurations before passing them to the authentication libraries. An attacker can exploit this by providing a malicious credential configuration containing crafted credential_source.file paths or credential_source.url endpoints, resulting in arbitrary file reads or SSRF attacks.

Severity
High
CVSS
7.7 (3.1)
Published
2026-01-16
CISA KEV
Not currently listed
Ecosystem
software/application
Weaknesses
CWE-73, CWE-918

Affected products

No browser-safe affected-product rows are available.

Matched remediation archetype

Server-side request forgery and unintended proxying

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Inventory server-side URL fetchers, webhooks, importers, previews, redirects, proxies, and protocol handlers reachable from untrusted input.
  • Map egress paths to internal services, metadata endpoints, loopback, private address space, and privileged control planes.
  • Review DNS resolution, redirect, proxy, credential-forwarding, and URL parsing behavior without requesting sensitive targets.

Remediate safely

  • Replace arbitrary destinations with named integrations or a strict allowlist of schemes, hosts, ports, and paths.
  • Resolve and validate every destination and redirect hop, then enforce egress policy independently of application checks.
  • Remove ambient credentials and sensitive headers from fetchers; apply response size, time, and content limits.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.