CVE-2026-33557 Details
Description
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
A vulnerability exists in Apache Kafka versions 4.1.0 through 4.1.1, where the default JWT validator for OAUTHBEARER authentication does not properly validate the signature, issuer, or audience of JWT tokens. This flaw allows an attacker to create a JWT token from any issuer, with the 'preferred_username' claim set to any user, and have it accepted by the broker. To mitigate this issue, users are advised to upgrade to Kafka versions 4.1.2, 4.2.0 or later, or to explicitly set the 'sasl.oauthbearer.jwt.validator.class' configuration to 'org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator'.
Kafka users are advised to upgrade to version 4.1.2, 4.2.0 or later. If upgrading is not possible, the 'sasl.oauthbearer.jwt.validator.class' configuration should be set to 'org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-33557 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2459739 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.json | redhat-SADP | |
| http://www.openwall.com/lists/oss-security/2026/04/17/2 | CVE | Mailing List |
| https://kafka.apache.org/cve-list | [email protected] | Vendor Advisory |
| https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | [email protected] |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| apache kafka | >= 4.1.0, < 4.1.2 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | New CVE Received | [email protected] |
| Apr 20, 2026 | CVE Modified | CVE |