Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Kafka | 4.1.0 – 4.1.1 | — | No fix listed | CNA |
| — | org.apache.kafka:kafka-clients (Maven) | 4.1.0 to before 4.1.2 | 4.1.2 | Patch available | GHSA-28jg-cgg7-j4wc |
- Apache Kafka VendorApache Affected 4.1.0 – 4.1.1 Fixed in — No fix listed CNA
- org.apache.kafka:kafka-clients (Maven) Vendor— Affected 4.1.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-28jg-cgg7-j4wc
Remediation
- Fix · GHSA-28jg-cgg7-j4wc org.apache.kafka:kafka-clients (Maven) Fixed in 4.1.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat build of Debezium 3 | Affected | No fix planned: Will not fix |
| streams for Apache Kafka 3 | Affected | No fix yet |
Not affected: 16 products
- OpenShift Serverless
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Process Automation 7
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 2
- Red Hat build of Apicurio Registry 3
- Red Hat build of Debezium 2
- Red Hat build of Quarkus
- streams for Apache Kafka 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33557
- 2026-10-03 Alias added: GHSA-28jg-cgg7-j4wc
References
Advisory 3
More Apache Kafka vulnerabilities
- TI-2025-20589 Apache Kafka Client: Arbitrary file read and SSRF vulnerability CVSS 3.1HIGH 7.5
- TI-2018-12295 Improper input validation in Apache Kafka CVSS 3.0HIGH 8.8
- TI-2025-20590 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration CVSS 3.1HIGH 8.8
- TI-2022-15706 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers CVSS 3.1HIGH 7.5
- TI-2025-20591 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration CVSS 3.1HIGH 7.5
- TI-2019-09246 Cleartext transmission of sensitive information in Apache Kafka CVSS 3.1HIGH 7.5
Sources
- CVE-2026-33557 · CVE Program
- CVE-2026-33557 · NVD
- FIRST EPSS
- GHSA-28jg-cgg7-j4wc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33557 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences