Vulnerability in Apache Kafka Broker's SASL/OAUTHBEARER Configuration

CVE-2026-110985

What is CVE-2026-110985?

A vulnerability exists in Apache Kafka brokers using SASL/OAUTHBEARER with the default validator. If the JWKS endpoint URL is not provided, the default validator reverts to a non-verifying implementation, allowing unauthenticated attackers to forge valid JWTs. This can grant them unauthorized access to the cluster, including privileges of configured superusers. The issue affects brokers not configured for JWT signature verification, posing a significant security risk. Apache Kafka versions 4.2.2, 4.3.1, and 4.4.0 resolve this by preventing the broker from starting in an insecure configuration.

References