CVE-2026-42316 KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto
Privileged users can inject KQL commands via connector configuration to tamper with Azure Data Explorer schemas and policies.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42316?
CVE-2026-42316 is a medium-severity code injection vulnerability in kafka-sink-azure-kusto, published on 11 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer (Kusto). Prior to 5.2.3, kafka-sink-azure-kusto did not sanitize user-controlled values inside the kusto.tables.topics.mapping configuration. The db, table, mapping, and format fields of each mapping entry were interpolated directly into KQL management/query commands via String.formatted(...) (e.g., FETCH_TABLE_COMMAND.formatted(table) → "<table> | count", FETCH_TABLE_MAPPING_COMMAND.formatted(table, format, mapping) → ".show table <table> ingestion <format> mapping '<mapping>'"). An actor able to influence the connector configuration (for example, someone with permissions to submit or edit Kafka Connect connector configs) could embed KQL metacharacters (;, |, ') to execute arbitrary management commands in the context of the connector's service principal — enabling schema enumeration/modification, ingestion-mapping tampering, or changes to streaming/retention policies on the target Azure Data Explorer database. This is a tampering vulnerability. Exploitation requires privileged access to the connector configuration; no end-user interaction or Kafka record payload is involved. This vulnerability is fixed in 5.2.3.
Weakness: CWE-943
Which versions are affected by CVE-2026-42316?
How do I fix CVE-2026-42316?
No fix has been published for CVE-2026-42316 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-42316 being exploited?
There is no known exploitation of CVE-2026-42316 in the wild and no public exploit code.
Sources
Also known as GHSA-c9mr-mqvh-6wgj.