Skip to content
fr Sign in
Not rated

CVE-2026-33557 A possible security vulnerability has been identified in Apache Kafka

Description

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

Affected products and versions

Product Affected versions Fixed in
Apache Kafka 4.1 4.1.0 → 4.1.1 No fix stated
Red Hat build of Debezium 3 Versions not published
streams for Apache Kafka 3 Versions not published
OpenShift Serverless Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat build of Debezium 2 Versions not published
Show the 10 other branches
Product Affected versions Fixed in
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Process Automation 7 Versions not published
streams for Apache Kafka 2 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Kafka

The 23 CVEs of Apache Kafka →
CVE-2026-114349 Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches Not rated CVE-2026-112375 Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs Not rated CVE-2026-116593 Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint Not rated CVE-2026-115644 Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions Not rated
Track this CVE