{"id":"CVE-2026-15911","title":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.","summary":"Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-295"],"vendor":"confluent","product":"confluent-kafka","affected":["confluent-kafka <= 2.14.2"],"published":"2026-10-01","updated":"2026-10-06","sourceUpdated":"2026-10-06T02:17:04.960","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15911","references":[{"url":"https://support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration","label":"psirt@us.ibm.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15911.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-15911"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544809"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15911"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15911"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-06T02:00:19.695616Z"},"epss":0.00297,"epssPercentile":0.22228,"exploits":{"github":1,"githubRepos":["https://github.com/rahulreddykarne/CVE-2026-15911-Confluent_Kafka"],"checkedAt":"2026-10-27T17:00:07.105Z"},"exploitAvailable":true,"ingestedAt":"2026-10-01T18:55:42.392Z","slug":"CVE-2026-15911","body":"## Overview\n\nConfluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Satellite 6 · no fix planned: Red Hat Satellite 6 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15911.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":215626,"id":"CVE-2026-15911","ts":1791156173706,"field":"exploit_available","old":"false","new":"true"}]}