CVE-2026-33557: Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
A possible security vulnerability has been identified in Apache Kafka.
By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the preferredusername set to any user, and the broker will accept it.
We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config sasl.oauthbearer.jwt.validator.class to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kafkato a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
Apache Kafkato a version that resolves this vulnerability.Fixed in 4.2.0 - Configuration
On Kafka versions v4.1.0 or v4.1.1, explicitly set sasl.oauthbearer.jwt.validator.class to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator to ensure JWT token validation (signature, issuer, and audience) instead of accepting any JWT token.
Apache Kafka broker (OAUTHBEARER) sasl.oauthbearer.jwt.validator.class = org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33557?
CVE-2026-33557 is considered a high-severity vulnerability due to improper JWT token validation in OAUTHBEARER authentication.
How do I fix CVE-2026-33557?
To fix CVE-2026-33557, update Apache Kafka to version 4.1.2 or later, which addresses the missing JWT token validation.
What are the risks associated with CVE-2026-33557?
CVE-2026-33557 can allow unauthenticated users to gain access by bypassing the token validation, potentially exposing sensitive data.
Which versions of Apache Kafka are affected by CVE-2026-33557?
CVE-2026-33557 affects Apache Kafka versions 4.1.0 to 4.1.1.
Is there a workaround for CVE-2026-33557?
For CVE-2026-33557, configuring a custom JWT validator may serve as a temporary workaround until the software is updated.