PT-2026-39660 · Unknown · Kafka-Sink-Azure-Kusto

Nekros1Xx · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-42316

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions kafka-sink-azure-kusto versions prior to 5.2.3

Description The plugin fails to sanitize user-controlled values within the kusto.tables.topics.mapping configuration. Specifically, the db, table, mapping, and format fields are interpolated directly into Kusto Query Language (KQL) management and query commands using the String.formatted() function. An attacker with permissions to submit or edit Kafka Connect connector configurations can embed KQL metacharacters such as ;, |, and ' to execute arbitrary management commands. This allows for schema enumeration or modification, tampering with ingestion mappings, and altering streaming or retention policies on the target Azure Data Explorer database using the connector's service principal privileges.

Recommendations Update kafka-sink-azure-kusto to version 5.2.3.

Exploit

Fix

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2026-42316

GHSA-C9MR-MQVH-6WGJ

Affected Products

Kafka-Sink-Azure-Kusto

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42316.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42316 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42316 · Vendor Advisory
• https://github.com/Azure/kafka-sink-azure-kusto/releases/tag/v5.2.3 · Note
• https://github.com/Azure/kafka-sink-azure-kusto/pull/155 · Note
• https://github.com/Azure/kafka-sink-azure-kusto/security/advisories/GHSA-c9mr-mqvh-6wgj · Note