---
id: CVE-2026-15911
title: >-
  Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a
  remote attacker to obtain sensitive information due to improper TLS
  certificate validation.
summary: >-
  Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a
  remote attacker to obtain sensitive information due to improper TLS
  certificate validation.
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-295
vendor: confluent
product: confluent-kafka
affected:
  - confluent-kafka <= 2.14.2
published: '2026-10-01'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T02:17:04.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15911'
references:
  - url: >-
      https://support.confluent.io/hc/en-us/articles/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration
    label: psirt@us.ibm.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15911.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-15911'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2544809'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-15911'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15911'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-06T02:00:19.695616Z'
epss: 0.00297
epssPercentile: 0.22228
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/rahulreddykarne/CVE-2026-15911-Confluent_Kafka'
  checkedAt: '2026-10-27T17:00:07.105Z'
exploitAvailable: true
ingestedAt: '2026-10-01T18:55:42.392Z'
---

## Overview

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Satellite 6 · no fix planned: Red Hat Satellite 6 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15911.json)