CVE-2026-42316

{
  "id": "CVE-2026-42316",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T18:16:35.400",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer (Kusto). Prior to 5.2.3, kafka-sink-azure-kusto did not sanitize user-controlled values inside the kusto.tables.topics.mapping configuration. The db, table, mapping, and format fields of each mapping entry were interpolated directly into KQL management/query commands via String.formatted(...) (e.g., FETCH_TABLE_COMMAND.formatted(table) → \"<table> | count\", FETCH_TABLE_MAPPING_COMMAND.formatted(table, format, mapping) → \".show table <table> ingestion <format> mapping '<mapping>'\"). An actor able to influence the connector configuration (for example, someone with permissions to submit or edit Kafka Connect connector configs) could embed KQL metacharacters (;, |, ') to execute arbitrary management commands in the context of the connector's service principal — enabling schema enumeration/modification, ingestion-mapping tampering, or changes to streaming/retention policies on the target Azure Data Explorer database. This is a tampering vulnerability. Exploitation requires privileged access to the connector configuration; no end-user interaction or Kafka record payload is involved. This vulnerability is fixed in 5.2.3."
    },
    {
      "lang": "es",
      "value": "El plugin kafka-sink-azure-kusto de Kafka Connect es el sink oficial de Microsoft para Azure Data Explorer (Kusto). Antes de la versión 5.2.3, kafka-sink-azure-kusto no saneaba los valores controlados por el usuario dentro de la configuración kusto.tables.topics.mapping. Los campos db, table, mapping y format de cada entrada de mapeo se interpolaban directamente en comandos de gestión/consulta de KQL a través de String.formatted(...) (por ejemplo, FETCH_TABLE_COMMAND.formatted(table) ? ’[table] | count’, FETCH_TABLE_MAPPING_COMMAND.formatted(table, format, mapping) ? ’.show table [table] ingestion [format] mapping ’[mapping]’’). Un actor capaz de influir en la configuración del conector (por ejemplo, alguien con permisos para enviar o editar configuraciones de conectores de Kafka Connect) podría incrustar metacaracteres de KQL (;, |, ’) para ejecutar comandos de gestión arbitrarios en el contexto del principal de servicio del conector - lo que permitiría la enumeración/modificación de esquemas, la manipulación de mapeos de ingesta o cambios en las políticas de streaming/retención en la base de datos de destino de Azure Data Explorer. Esto es una vulnerabilidad de manipulación. La explotación requiere acceso privilegiado a la configuración del conector; no se requiere interacción del usuario final ni carga útil de registro de Kafka. Esta vulnerabilidad está corregida en la versión 5.2.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Azure",
          "product": "kafka-sink-azure-kusto",
          "versions": [
            {
              "version": "< 5.2.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T17:27:18.333065Z",
          "id": "CVE-2026-42316",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Azure/kafka-sink-azure-kusto/pull/155",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Azure/kafka-sink-azure-kusto/releases/tag/v5.2.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Azure/kafka-sink-azure-kusto/security/advisories/GHSA-c9mr-mqvh-6wgj",
      "source": "[email protected]"
    }
  ]
}