PT-2026-33633 · Apache+1 · Apache Kafka+1

Bzimport · CVE-2026-33557 · Published 2026-04-17 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 4.1.0 through 4.1.1

Description An authentication bypass exists because the default broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. This class fails to validate JSON Web Token (JWT) signatures, issuers, or audiences. A remote attacker can exploit this by crafting a malicious JWT token with an arbitrary preferred username to impersonate any user and gain unauthorized access to the Kafka broker. Approximately 9,000 instances have been identified globally.

Recommendations For versions 4.1.0 through 4.1.1, set the sasl.oauthbearer.jwt.validator.class configuration to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator explicitly. Update to version 4.1.2 or 4.2.0 and later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1285

CWE-303

Related Identifiers

BDU:2026-09403

BIT-KAFKA-2026-33557

CVE-2026-33557

GHSA-28JG-CGG7-J4WC

Affected Products

Apache Kafka

Red Os

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33557.json · Exploit
• https://bdu.fstec.ru/vul/2026-09403 · Security Note
• https://osv.dev/vulnerability/BIT-kafka-2026-33557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33557 · Security Note
• https://kafka.apache.org/cve-list · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33557 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33557 · Vendor Advisory
• https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-28jg-cgg7-j4wc · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33557 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33557 · Security Note
• https://github.com/apache/kafka/commit/01d8e7db8d08dbd538892b409457ea6bfcc2a422 · Note
• https://github.com/apache/kafka · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-apache-kafka-cve-2026-33557-8.0 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-apache-kafka-cve-2026-33557-7.3 · Note