CVE-2026-110952: Apache Kafka · Insufficient Verification of Data Authenticity
Affects Apache KafkaSource CVE Database V5
Not known to be exploited : upgrade to 4.4.0 soon.
Data as of 28 Oct 2026, 17:22 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- Patch
- Available – fixed in 4.4.0
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Apache to 4.4.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Kafkaorg.apache.kafka:kafka | Affected
| Fixed in
|
MavenApache Software Foundation/org.apache.kafka:kafkapkg:maven/Apache Software Foundation/org.apache.kafka:kafkaOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
For all affected versions (>=3.1.0 <4.4.0), set sasl.oauthbearer.expected.issuer to the exact expected issuer value and sasl.oauthbearer.expected.audience to the expected audience(s) per listener to enforce strict issuer and audience checks. From version 4.4.0 onward, these settings are mandatory for brokers configured with a JWKS endpoint, making the system secure by default. Deployments that intentionally do not restrict issuer or audience can opt out using sasl.oauthbearer.allow.unverified.issuer=true and/or sasl.oauthbearer.allow.unverified.audience=true.
Description
Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator verify JWT signatures but do not enforce issuer and audience claim checks by default. This can allow tokens from different issuers or without audience claims to authenticate if the JWKS endpoint serves keys for multiple issuers. From version 4.4.0, Kafka requires explicit configuration of issuer and audience checks or allows opting out. Versions 3.1.0 through before 4.4.0 are affected if these settings are not configured.