[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b76c9d86-87ae-a60c-6b38-c968809df9c8@apache.org>
Date: Fri, 17 Apr 2026 08:15:56 +0000
From: Luke Chen <showuon@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-33557: Apache Kafka: Missing JWT token validation in
OAUTHBEARER authentication
Severity: important
Affected versions:
- Apache Kafka 4.1.0 through 4.1.1
Description:
A possible security vulnerability has been identified in Apache Kafka.
By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.
We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
Credit:
Павел Романов <promanov1994@...il.com> (finder)
References:
https://kafka.apache.org/cve-list
https://kafka.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-33557
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
