PT-2026-33633 · Apache · Apache Kafka

Published 2026-04-19 · Updated 2026-04-25 · CVE-2026-33557

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 4.1.0 through 4.1.1

Description An issue exists in the OAUTHBEARER authentication mechanism where the broker property sasl.oauthbearer.jwt.validator.class defaults to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. This default validator accepts any JSON Web Token (JWT) without validating its signature, issuer, or audience. Consequently, an attacker can forge a JWT token from any issuer with the preferred username set to any user to impersonate them and bypass security policies.

Recommendations For versions 4.1.0 through 4.1.1, explicitly set the config sasl.oauthbearer.jwt.validator.class to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator. Update to version 4.1.2 or 4.2.0.

Fix

Weakness Enumeration

CWE-1285

Related Identifiers

BIT-KAFKA-2026-33557

CVE-2026-33557

GHSA-28JG-CGG7-J4WC

Affected Products

Apache Kafka

References · 17

• https://ubuntu.com/security/CVE-2026-33557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33557 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33557 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-28jg-cgg7-j4wc · Vendor Advisory
• https://kafka.apache.org/cve-list · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33557 · Security Note
• https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kafka-2026-33557 · Vendor Advisory
• https://github.com/apache/kafka · Note
• https://github.com/apache/kafka/commit/01d8e7db8d08dbd538892b409457ea6bfcc2a422 · Note
• http://openwall.com/lists/oss-security/2026/04/17/2 · Note
• https://twitter.com/CCBalert/status/2046586366511726834 · Twitter Post
• https://twitter.com/pulsepatchio/status/2047871347527668178 · Twitter Post
• https://twitter.com/Netlas_io/status/2046618609246482627 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2045760336368664826 · Twitter Post