CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

As cited

Copy frozen at 2026-10-28 21:26 UTC (site build).

vulnerabilities

CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

Apache Kafka brokers using SASL/OAUTHBEARER authentication with the bundled JWKS validator verify JWT signatures by default but skip issuer and audience claim validation unless explicitly configured. Versions 3.1.0 through 4.3.x are affected, leaving brokers vulnerable to tokens from untrusted issuers or with incorrect audience claims when these validations are not manually enabled.

Why it matters: Organizations running affected Kafka versions with SASL/OAUTHBEARER should immediately verify that sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience are explicitly set, as the default behavior accepts improperly scoped tokens and increases unauthorized access risk.

Source published

2026-10-28 17:25 UTC

First seen by Cybersecurity Tracker

2026-10-28 20:02 UTC