French agency warns of multiple Apache Kafka security flaws
France's national cyber agency, CERT-FR, issued an advisory on 29 October 2026 warning of multiple security flaws in Apache Kafka, a widely used open-source system for moving large streams of data between software applications. Some flaws could let a remote attacker crash the service, read data they should not see, or alter data. Versions 4.3.x before 4.3.2 and versions before 4.2.2 are affected, and CVE-2026-110952 also affects versions before 4.4.0.
What does it mean?
If your organization runs Apache Kafka, the software that moves data between applications, it should install the patched version soon. Attackers could potentially crash the service or access and change data. The affected versions are listed in the advisory, and the fixes are in the publisher's bulletin.
Who is affected?
Organizations and developers who run Apache Kafka versions 4.3.x before 4.3.2 or earlier than 4.2.2.