A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always
Source GCVE Database
Not known to be exploited : upgrade to 4.4.0 soon.
Data as of 28 Oct 2026, 19:57 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- Patch
- Available – fixed in 4.4.0
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Apache to 4.4.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Kafkaorg.apache.kafka:kafka | Affected
| Fixed in
|
MavenApache Software Foundation/org.apache.kafka:kafkapkg:maven/Apache Software Foundation/org.apache.kafka:kafkaOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Set both sasl.oauthbearer.expected.issuer to the exact issuer value of your identity provider and sasl.oauthbearer.expected.audience to the expected audience(s) for your brokers, per listener. This enforces exact-match checks on issuer and audience claims and mitigates the vulnerability. These configuration options have been available since Apache Kafka 3.1.0. From version 4.4.0, brokers require these settings to start when configured with a JWKS endpoint, ensuring secure defaults. Deployments that intentionally do not restrict issuer or audience can opt out using sasl.oauthbearer.allow.unverified.issuer=true and/or sasl.oauthbearer.allow.unverified.audience=true.
Description
A vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator allows tokens with valid signatures but missing or incorrect issuer (iss) and audience (aud) claims to be accepted by default. This occurs because the issuer and audience checks are only enforced if explicitly configured. This can lead to acceptance of tokens minted by different issuers or lacking audience claims, potentially allowing unauthorized authentication.