SASL/OAUTHBEARER Vulnerability in Apache Kafka Broker

CVE-2026-110952

What is CVE-2026-110952?

A configuration gap in the Apache Kafka broker undermines the integrity of JWT authentication. When utilizing SASL/OAUTHBEARER with a JWKS-backed validator, the broker only verifies certain security claims if specifically configured. By default, the issuer (iss) and audience (aud) claims are not enforced, leaving an opening for potentially unauthorized tokens to be accepted for authentication. This can lead to scenarios where tokens issued by different identity providers gain higher privileges if proper checks are not implemented. Administrators are advised to configure these settings to ensure robust security and prevent unauthorized access.

References