An attacker needs access to the Kafka Connect REST API endpoint /connector-plugins/{connector-type}/config/validate on a Connect worker. Exposure is relevant where that endpoint is reachable by an untrusted or insufficiently trusted user.
The endpoint can be used to resolve and return plaintext values from configuration providers installed on the Connect worker. This defeats the intended runtime-only handling of sensitive configuration-provider values.
Affected releases are Apache Kafka 2.4.0 before 4.2.2 and 4.3.0 before 4.3.2. Versions 4.2.2, 4.3.2, 4.4.0, and later are identified as fixed.
Restrict access to the Connect REST API validation endpoint to trusted users, especially on workers with configuration providers installed. This reduces the ability to invoke provider resolution through the vulnerable endpoint.