CVE-2025-30677

mediumpriority · track · 26EPSS 0.007 · 54 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.73% (54th) EPSS

CVSS 6.5 · medium

Is it mine?

21 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-28

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue. This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4. 3.0.x version users should upgrade to at least 3.0.11. 3.3.x version users should upgrade to at least 3.3.6. 4.0.x version users should upgrade to at least 4.0.4. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.3–6.5

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.14.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:Nsecondary · ENISA EU

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security@apache.org

v4.02.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-532USCWE-532USCWE-532US

affected products (21)

Products and version ranges known to be affected.

Apache Software Foundation Apache Pulsar IO Kafka Connect Adaptor2.3.0 → 3.0.11enisa_euvdEU
Apache Software Foundation Apache Pulsar IO Kafka Connect Adaptor3.1.0 → 3.3.6enisa_euvdEU
Apache Software Foundation Apache Pulsar IO Kafka Connect Adaptor4.0.0 → 4.0.4enisa_euvdEU
Apache Software Foundation Apache Pulsar IO Kafka Connector2.3.0 → 3.0.11enisa_euvdEU
Apache Software Foundation Apache Pulsar IO Kafka Connector3.1.0 → 3.3.6enisa_euvdEU
Apache Software Foundation Apache Pulsar IO Kafka Connector4.0.0 → 4.0.4enisa_euvdEU
Apache Software Foundation Pulsar IO Kafka Connect Adaptor2.3.0 → 3.0.11fstec_bduRU
Apache Software Foundation Pulsar IO Kafka Connect Adaptor3.1.0 → 3.3.6fstec_bduRU
Apache Software Foundation Pulsar IO Kafka Connect Adaptor4.0.0 → 4.0.4fstec_bduRU
Apache Software Foundation Pulsar IO Kafka Connector2.3.0 → 3.0.11fstec_bduRU
Apache Software Foundation Pulsar IO Kafka Connector3.1.0 → 3.3.6fstec_bduRU
Apache Software Foundation Pulsar IO Kafka Connector4.0.0 → 4.0.4fstec_bduRU
apache pulsar2.3.0 → 3.0.11nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
apache pulsar3.3.0 → 3.3.6nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
apache pulsar4.0.0 → 4.0.4nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
Maven org.apache.pulsar:pulsar-io-kafka< 3.0.11osvUSpkg:maven/org.apache.pulsar/pulsar-io-kafka
Maven org.apache.pulsar:pulsar-io-kafka3.3.0 → 3.3.6osvUSpkg:maven/org.apache.pulsar/pulsar-io-kafka
Maven org.apache.pulsar:pulsar-io-kafka4.0.0 → 4.0.4osvUSpkg:maven/org.apache.pulsar/pulsar-io-kafka
Maven org.apache.pulsar:pulsar-io-kafka-connect-adaptor< 3.0.11osvUSpkg:maven/org.apache.pulsar/pulsar-io-kafka-connect-adaptor
Maven org.apache.pulsar:pulsar-io-kafka-connect-adaptor3.3.0 → 3.3.6osvUSpkg:maven/org.apache.pulsar/pulsar-io-kafka-connect-adaptor

showing 20 of 21

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-rcqj-3fmp-5cqxApache Pulsar Kafka Connector Logs Sensitive Information in Application Logs2025-04-09ghsa · osvUS
Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue. This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4. 3.0.x version users should upgrade to at least 3.0.11. 3.3.x version users should upgrade to at least 3.3.6. 4.0.x version users should upgrade to at least 4.0.4. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2025-04-09modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/04/09/2 cnnvd
https://lists.apache.org/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3d cnnvd
https://pulsar.apache.org/security/cnnvd
https://lists.apache.org/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3d enisa_euvd
https://pulsar.apache.org/security/enisa_euvd
http://www.openwall.com/lists/oss-security/2025/04/09/2Mailing ListThird Party Advisorynvd
https://lists.apache.org/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3dMailing ListVendor Advisorynvd
https://pulsar.apache.org/security/Vendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan