GHSA-55vq-xpjf-r2xcMediumCVSS 5.5

Lightbend Alpakka Kafka logs credentials on debug level

Published
April 27, 2023
Last Modified
September 30, 2025

🔗 CVE IDs covered (1)

CVE-2023-29471 →

📋 Description

Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

🎯 Affected products4

  • maven/com.typesafe.akka:akka-stream-kafka_3:< 4.0.2
  • maven/com.typesafe.akka:akka-stream-kafka_2.13:< 4.0.2
  • maven/com.typesafe.akka:akka-stream-kafka_2.12:< 4.0.2
  • maven/com.typesafe.akka:akka-stream-kafka_2.11:< 4.0.2

🔗 References (5)