Is CVE-2026-33558 actively exploited?

No active exploitation of CVE-2026-33558 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33558 be exploited remotely?

Yes. CVE-2026-33558 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33558?

CVE-2026-33558 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33558

MEDIUM

CVE-2026-33558

CWE-533Published: April 20, 2026· Updated: Apr 22, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.7th

Official Description

Information exposure vulnerability has been identified in Apache Kafka.

The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are:

* AlterConfigsRequest

* AlterUserScramCredentialsRequest

* ExpireDelegationTokenRequest

* IncrementalAlterConfigsRequest

* RenewDelegationTokenRequest

* SaslAuthenticateRequest

* createDelegationTokenResponse

* describeDelegationTokenResponse

* SaslAuthenticateResponse

This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.

NVD Source

Technical Analysis

CVE-2026-33558 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.