A Kafka broker using SASL/OAUTHBEARER with the default validator
Source GCVE Database
Mentioned vulnerabilities
Not known to be exploited.
Data as of 28 Oct 2026, 19:58 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Kafkaorg.apache.kafka:kafka | Affected
| Fixed in– |
MavenApache Software Foundation/org.apache.kafka:kafkapkg:maven/Apache Software Foundation/org.apache.kafka:kafkaOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Set the configuration parameter sasl.oauthbearer.jwks.endpoint.url for every listener and mechanism using OAuthBearerValidatorCallbackHandler to ensure JWT signature verification. Alternatively, configure a custom signature-verifying sasl.oauthbearer.jwt.validator.class. No upgrade is required to mitigate if these configurations are applied. For brokers running Apache Kafka 4.2.2, 4.3.1, or 4.4.0 and later, the broker will fail to start if misconfigured, preventing insecure operation by default.
Description
A vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER with the default validator and no JWKS endpoint URL set allows acceptance of any structurally valid JWT without signature verification. This enables unauthenticated remote attackers to forge tokens asserting any principal, including superusers, gaining full cluster access. The issue affects brokers that enable SASL/OAUTHBEARER validation without configuring a JWKS endpoint URL or a custom signature-verifying validator. From Apache Kafka versions 4.2.2, 4.3.1, and 4.4.0, brokers fail to start if misconfigured, preventing insecure operation.