← Vulnerability feed

Vulnerability record · CVE-2026-33557 · published 20 April 2026

CVE-2026-33557: Apache kafka vulnerability

Apache · Kafka

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

9.1 CVSS 3.1 Critical EPSS 0.93% · top 40.8% CWE-1285 · CWE-1285CWE-303 · CWE-303
9.1CVSS 3.1 base score
0.93%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
15 Jul 2026Last modified by NVD

Description

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kafka.apache.org/cve-list Vendor Advisory
https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h MitigationVendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/17/2 Mailing List
https://access.redhat.com/security/cve/CVE-2026-33557
https://bugzilla.redhat.com/show_bug.cgi?id=2459739
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.json

Track CVE-2026-33557 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2025-27818Apache kafka deserialization of untrusted data vulnerabilityA possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connec…EPSS 1.0%8.8CVE-2018-17196Apache kafka vulnerabilityIn Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL val…EPSS 5.5%8.7CVE-2026-35554Apache kafka race condition vulnerabilityA race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. W…EPSS 0.65%7.5CVE-2025-27817Apache Kafka Client arbitrary file read and SSRF via SASL/OAUTHBEARER URLsApache Kafka Clients accept SASL/OAUTHBEARER configuration values such as sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url,…EPSS 69%analysed7.5CVE-2025-27819Apache kafka deserialization of untrusted data vulnerabilityIn CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka…EPSS 1.0%7.5CVE-2022-34917Apache kafka allocation without limits vulnerabilityA security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated…EPSS 1.5%7.5CVE-2019-12399Apache kafka cleartext transmission vulnerabilityWhen Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a conne…EPSS 3.9%7.4CVE-2024-27309Apache kafka incorrect authorization vulnerabilityWhile an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditio…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2026-33557), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.