CVE Explorer

CVE-2026-42316

kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer (Kusto). Prior to 5.2.3, kafka-sink-azure-kusto did not sanitize user-controlled values inside the kusto.tables.topics.mapping configuration. The db, table, mapping, and format fields of each mapping entry were interpolated directly into KQL management/query commands via String.formatted(...) (e.g., FETCH_TABLE_COMMAND.formatted(table) → "<table> | count", FETCH_TABLE_MAPPING_COMMAND.formatted(tabl

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3e1caacd197b8d75cf243bcc6c0c5f37157ac1b662054bbae1d838c115055db6

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"kafka-sink-azure-kusto","vendor":"Azure","versions":[{"status":"affected","version":"< 5.2.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a79f463010f44f67bc2a04d90850049c7f8bd59224ecd16623260bb974208189 · sha256:2b45af351efb1e27… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:a79f463010f44f67bc2a04d90850049c7f8bd59224ecd16623260bb974208189 · sha256:2b45af351efb1e27… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-943","description":"CWE-943: Improper Neutralization of Special Elements in Data Query Logic","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:a79f463010f44f67bc2a04d90850049c7f8bd59224ecd16623260bb974208189 · sha256:2b45af351efb1e27… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions

{"name":"https://github.com/Azure/kafka-sink-azure-kusto/pull/155","tags":["x_refsource_MISC"],"url":"https://github.com/Azure/kafka-sink-azure-kusto/pull/155"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a79f463010f44f67bc2a04d90850049c7f8bd59224ecd16623260bb974208189 · sha256:2b45af351efb1e27… · /containers/cna/references/1

{"name":"https://github.com/Azure/kafka-sink-azure-kusto/releases/tag/v5.2.3","tags":["x_refsource_MISC"],"url":"https://github.com/Azure/kafka-sink-azure-kusto/releases/tag/v5.2.3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a79f463010f44f67bc2a04d90850049c7f8bd59224ecd16623260bb974208189 · sha256:2b45af351efb1e27… · /containers/cna/references/2

{"name":"https://github.com/Azure/kafka-sink-azure-kusto/security/advisories/GHSA-c9mr-mqvh-6wgj","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Azure/kafka-sink-azure-kusto/security/advisories/GHSA-c9mr-mqvh-6wgj"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a79f463010f44f67bc2a04d90850049c7f8bd59224ecd16623260bb974208189 · sha256:2b45af351efb1e27… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer