CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11678

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

CVE-2026-110985 affects Apache Kafka 4.1.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 when using SASL/OAUTHBEARER authentication with the default JWT validator. The broker silently skips JWT signature verification when the JWKS endpoint URL is not configured, leaving a security gap in the default configuration.

Why it matters: Kafka operators using OAUTHBEARER authentication without an explicitly configured JWKS endpoint URL face a critical authentication bypass: tokens are accepted without signature validation, allowing unauthenticated access to brokers.

CVEsCVE-2026-110985
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary