CVE-2025-30677

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30677
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30677.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30677
Aliases
Published
2025-04-09T12:15:15.363Z
Modified
2026-03-14T14:28:47.952652Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs.

This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue.

This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4.

3.0.x version users should upgrade to at least 3.0.11.

3.3.x version users should upgrade to at least 3.3.6.

4.0.x version users should upgrade to at least 4.0.4.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

References

Affected packages

Git / github.com/apache/pulsar

Affected ranges

Type
GIT
Repo
https://github.com/apache/pulsar
Events
Introduced
52fc45e990800c9a34147b6c4ed5080a79dd2d99
Fixed
a51279eb79abafd7a12d8a82db33f4899e58d1d2
Introduced
c0aab493aafa5386dbf93c0b58a66a666aeba17a
Fixed
c1c18d6872bd2e824ed87f7b974191813eb4b987
Introduced
92448d5f3113d783d41de6bae718d34cd73ca934
Fixed
5685bb6fd4e8ee806ff75ab5a87cd4664a7c8e2f
Database specific 
{
    "versions": [
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "3.0.11"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.6"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.4"
        }
    ]
}

Affected versions

v3.*
v3.3.0
v3.3.0-candidate-4
v3.3.1
v3.3.1-candidate-1
v3.3.2
v3.3.2-candidate-1
v3.3.3
v3.3.3-candidate-1
v3.3.3-candidate-2
v3.3.4
v3.3.4-candidate-1
v3.3.4-candidate-2
v3.3.5
v3.3.5-candidate-1
v3.3.5-candidate-2
v4.*
v4.0.0
v4.0.0-candidate-1
v4.0.1
v4.0.1-candidate-1
v4.0.1-candidate-2
v4.0.2
v4.0.2-candidate-1
v4.0.2-candidate-2
v4.0.2-candidate-3
v4.0.3
v4.0.3-candidate-1
v4.0.3-candidate-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30677.json"