CVE-2026-112375: Missing Authorization

An authenticated Kafka principal with no authorization grants not even ALTERCONFIGS can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs or AlterConfigs request targeting a BROKER resource reaches the broker's...