The vulnerability in Apache Kafka relates to improper validation of JWT tokens in the SASL OAuthBearer authentication mechanism. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to a validator that does not verify the JWT signature, issuer, or audience, effectively accepting any token. This allows attackers to generate tokens from arbitrary issuers with any preferred_username, bypassing authentication controls. Kafka versions 4.1.2 and later have corrected this by enforcing proper JWT validation. Users running versions 4.1.0 or 4.1.1 should manually set the validator class to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator to prevent exploitation.

An attacker can impersonate any user by presenting a crafted JWT token that is accepted by the broker without proper validation. This could lead to unauthorized access to Kafka resources and potential data exposure or manipulation. There are no known exploits in the wild at this time.

Users running Apache Kafka versions 4.1.0 or 4.1.1 should explicitly set the broker configuration property sasl.oauthbearer.jwt.validator.class to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator to enforce proper JWT validation. Upgrading to Kafka version 4.1.2, 4.2.0, or later is recommended, as these versions include the fix by default. Patch status is not explicitly stated, but the vendor advisory indicates the issue is fixed in later versions.