CVE-2026-33557

The record

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

Affected packages

Related vulnerabilities

• CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. CWE-1285
• CVE-2026-31912 libpcap BPF interpreter detects neither reaching the end of the filter program buffer due… CWE-1285
• CVE-2026-14479 A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser… CWE-1285
• CVE-2026-18485 There is a local privilege escalation vulnerability recently discovered in the NI-PAL… CWE-1285
• CVE-2026-12681 Improper Validation of Specified Index, Position, or Offset in Input vulnerability in… CWE-1285
• CVE-2026-8036 Improper input validation in NI-PAL may allow a local authenticated user to access… CWE-1285
• CVE-2026-45352 cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. CWE-1285
• CVE-2026-9100 The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the… CWE-1285