Hi Y'all, I acknowledge we received this report, and its findings are valid for the 1.9.2 artifact on Confluent Hub.
That artifact was not produced or uploaded by the Apache Iceberg Community. Confluent claims to be the creator of this zip as described in https://github.com/apache/iceberg/pull/15212 *"At the moment the 1.9.2 version of the connector has been uploaded to the site by Confluent staff as an ad-hoc process."* Because we didn't release that artifact, we won't be patching it. The good news is the Trivy scan which now runs on Iceberg is clean with a few exceptions. The only remaining findings are the four Jackson CVEs inside Parquet's bundled copy, which we're waiting on Apache Parquet to fix. These versions come from the jar lists in the CI scans of the 1.12.0 tag and of today's main commit 34927ff. The production of confluent release jars is on our side as #15212 <https://github.com/apache/iceberg/pull/15212>, which adds the Kafka Connect runtime zip to our official releases so the release manager can submit it to Confluent Hub. Since Confluent created this listing, you are the ones able to remove or replace it. We're fine with you removing 1.9.2 now, or leaving it up until a release artifact is submitted. In the future security issues should be sent to [email protected] rather than dev@ and issues@. Thanks, Russell Spitzer On Tue, Oct 27, 2026 at 10:39 AM confluent-hub.confluent.io via dev < [email protected]> wrote: > Dear Issues Team, > > We regularly perform security scans on Confluent Hub connectors, as per > Confluent’s security policy. Unfortunately *iceberg-iceberg-kafka-connect* > has been flagged as having vulnerabilities, and our policy is to escalate > the connector to removal stages, unless we receive confirmation that the > issues are being addressed by the partner. > > I have attached the vulnerability scan. Please note that we acknowledge > two exceptions for vulnerabilities raised: > > - Partner confirms that the vulnerability is a false positive > - Partner confirms that the issue is valid but not exploitable > > Please can you *acknowledge receipt of this email*, and as soon as > possible thereafter let us know your position on these vulnerabilities. > > Reminder emails will be sent on a weekly basis until all vulnerabilities > have been appropriately remediated, or the connector has been removed from > the Confluent Hub. > > If you require further information on any of the above, please do not > hesitate to get in touch. > > Best regards, > CCET Team >
