Kafka Connect deployments are affected only when admin.listeners is explicitly configured as a separate listener from the main listeners property and REST extensions are configured through rest.extension.classes. The exposed endpoints are those mounted on the separate admin listener, including /admin/loggers.
An attacker needs network access to the separate admin listener. No authentication is required for reading or writing the affected admin logger endpoint.
The issue is tied to explicitly isolating the admin REST API with admin.listeners. The primary REST API listener configured through listeners continues to enforce the configured authentication and authorization filters.
Review the Kafka Connect configuration for a separately configured admin.listeners value and REST extensions listed in rest.extension.classes. If both are present, verify whether the separate admin listener exposes /admin/loggers without the expected authentication controls.
Affected releases are Apache Kafka 2.4.0 before 4.2.2 and Apache Kafka 4.3.0 before 4.3.2. Update to the applicable fixed release line.