{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110985", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-15T11:31:31.708Z", "datePublished": "2026-10-28T16:37:45.688Z", "dateUpdated": "2026-10-28T16:37:45.688Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:37:45.688Z"}, "title": "Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured", "problemTypes": [{"descriptions": [{"description": "CWE-345 Insufficient Verification of Data Authenticity and its child", "lang": "en", "cweId": "CWE-345", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-347 Improper verification of cryptographic signature", "lang": "en", "cweId": "CWE-347", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-1287 Improper validation of specified type of input", "lang": "en", "cweId": "CWE-1287", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-636 Failing Open", "lang": "en", "cweId": "CWE-636", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "packageURL": "pkg:maven/org.apache.kafka/kafka", "versions": [{"status": "affected", "version": "4.1.0", "lessThanOrEqual": "4.1.2", "versionType": "semver"}, {"status": "affected", "version": "4.2.0", "lessThanOrEqual": "4.2.1", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.kafka:kafka"}], "descriptions": [{"value": "A Kafka broker using SASL/OAUTHBEARER with the default validator\u00a0(sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from\u00a0configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the\u00a0JWT signature. When that URL is unset (the default) and no verification key resolver is\u00a0supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not\u00a0verify the JWT signature, algorithm, or issuer - and the broker starts with no warning or\u00a0error. This is the residual of CVE-2026-33557, whose fix restored signature verification\u00a0only on the path where the JWKS endpoint URL is set.\n\n\nImpact:\n\nA broker in this state accepts any structurally valid JWT, including \"alg\":\"none\" tokens. An\u00a0unauthenticated remote attacker who can reach the listener can forge a token asserting any\u00a0principal - including configured superusers - and gain full access to the cluster. Only\u00a0brokers that enable SASL/OAUTHBEARER validation without a JWKS endpoint URL (and without a\u00a0custom verification key resolver) are affected; brokers that set the URL verify signatures\u00a0and are not affected. Unlike CVE-2026-110952 (issuer/audience not enforced by default), here\u00a0no signature is verified at all.\n\n\nMitigation (all affected versions, no upgrade required):\n\nSet sasl.oauthbearer.jwks.endpoint.url for every listener/mechanism that uses\u00a0OAuthBearerValidatorCallbackHandler, or configure a signature-verifying\u00a0sasl.oauthbearer.jwt.validator.class.\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.1, and 4.4.0: a broker that would fall back to the\u00a0non-verifying ClientJwtValidator fails to start with a ConfigException instead of running\u00a0without signature verification (secure by default).", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>A Kafka broker using SASL/OAUTHBEARER with the default validator&nbsp;<span>(sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from&nbsp;</span><span>configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the&nbsp;</span><span>JWT signature. When that URL is unset (the default) and no verification key resolver is&nbsp;</span><span>supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not&nbsp;</span><span>verify the JWT signature, algorithm, or issuer - and the broker starts with no warning or&nbsp;</span><span>error. This is the residual of CVE-2026-33557, whose fix restored signature verification&nbsp;</span><span>only on the path where the JWKS endpoint URL is set.</span></div><br><div>Impact:</div><div>A broker in this state accepts any structurally valid JWT, including \"alg\":\"none\" tokens. An&nbsp;<span>unauthenticated remote attacker who can reach the listener can forge a token asserting any&nbsp;</span><span>principal - including configured superusers - and gain full access to the cluster. Only&nbsp;</span><span>brokers that enable SASL/OAUTHBEARER validation without a JWKS endpoint URL (and without a&nbsp;</span><span>custom verification key resolver) are affected; brokers that set the URL verify signatures&nbsp;</span><span>and are not affected. Unlike CVE-2026-110952 (issuer/audience not enforced by default), here&nbsp;</span><span>no signature is verified at all.</span></div><br><div>Mitigation (all affected versions, no upgrade required):</div><div><div>Set sasl.oauthbearer.jwks.endpoint.url for every listener/mechanism that uses&nbsp;<span>OAuthBearerValidatorCallbackHandler, or configure a signature-verifying&nbsp;</span><span>sasl.oauthbearer.jwt.validator.class.<br></span><span><br>Resolution:</span></div><div><span>From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: a broker that would fall back to the&nbsp;</span><span>non-verifying ClientJwtValidator fails to start with a ConfigException instead of running&nbsp;</span><span>without signature verification (secure by default).&nbsp;</span></div></div>"}]}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "San Zhang <falaxe1642@gmail.com>", "type": "reporter"}, {"lang": "en", "value": "Kaixuan Li <kaixuanli0131@gmail.com>", "type": "reporter"}, {"lang": "en", "value": "Evan Zhou <ezhou@confluent.io>", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kafka:kafka", "packageURL": "pkg:maven/org.apache.kafka/kafka", "product": "Apache Kafka", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.1.2", "status": "affected", "version": "4.1.0", "versionType": "semver"}, {"lessThanOrEqual": "4.2.1", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Kafka broker using SASL/OAUTHBEARER with the default validator\u00a0(sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from\u00a0configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the\u00a0JWT signature. When that URL is unset (the default) and no verification key resolver is\u00a0supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not\u00a0verify the JWT signature, algorithm, or issuer - and the broker starts with no warning or\u00a0error. This is the residual of CVE-2026-33557, whose fix restored signature verification\u00a0only on the path where the JWKS endpoint URL is set.\n\n\nImpact:\n\nA broker in this state accepts any structurally valid JWT, including \"alg\":\"none\" tokens. An\u00a0unauthenticated remote attacker who can reach the listener can forge a token asserting any\u00a0principal - including configured superusers - and gain full access to the cluster. Only\u00a0brokers that enable SASL/OAUTHBEARER validation without a JWKS endpoint URL (and without a\u00a0custom verification key resolver) are affected; brokers that set the URL verify signatures\u00a0and are not affected. Unlike CVE-2026-110952 (issuer/audience not enforced by default), here\u00a0no signature is verified at all.\n\n\nMitigation (all affected versions, no upgrade required):\n\nSet sasl.oauthbearer.jwks.endpoint.url for every listener/mechanism that uses\u00a0OAuthBearerValidatorCallbackHandler, or configure a signature-verifying\u00a0sasl.oauthbearer.jwt.validator.class.\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.1, and 4.4.0: a broker that would fall back to the\u00a0non-verifying ClientJwtValidator fails to start with a ConfigException instead of running\u00a0without signature verification (secure by default)."}], "id": "CVE-2026-110985", "lastModified": "2026-10-29T15:04:37.187", "metrics": {}, "published": "2026-10-28T17:17:38.157", "references": [{"source": "security@apache.org", "url": "https://kafka.apache.org/cve-list"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-347"}, {"lang": "en", "value": "CWE-636"}, {"lang": "en", "value": "CWE-1287"}], "source": "security@apache.org", "type": "Primary"}]}

{"bugzilla": {"description": "org.apache.kafka/kafka-clients: Apache Kafka: Authentication bypass via missing JWT signature verification", "id": "2562962", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562962"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-347", "details": ["A Kafka broker using SASL/OAUTHBEARER with the default validator\u00a0(sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from\u00a0configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the\u00a0JWT signature. When that URL is unset (the default) and no verification key resolver is\u00a0supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not\u00a0verify the JWT signature, algorithm, or issuer - and the broker starts with no warning or\u00a0error. This is the residual of CVE-2026-33557, whose fix restored signature verification\u00a0only on the path where the JWKS endpoint URL is set.\nImpact:\nA broker in this state accepts any structurally valid JWT, including \"alg\":\"none\" tokens. An\u00a0unauthenticated remote attacker who can reach the listener can forge a token asserting any\u00a0principal - including configured superusers - and gain full access to the cluster. Only\u00a0brokers that enable SASL/OAUTHBEARER validation without a JWKS endpoint URL (and without a\u00a0custom verification key resolver) are affected; brokers that set the URL verify signatures\u00a0and are not affected. Unlike CVE-2026-110952 (issuer/audience not enforced by default), here\u00a0no signature is verified at all.\nMitigation (all affected versions, no upgrade required):\nSet sasl.oauthbearer.jwks.endpoint.url for every listener/mechanism that uses\u00a0OAuthBearerValidatorCallbackHandler, or configure a signature-verifying\u00a0sasl.oauthbearer.jwt.validator.class.\nResolution:\nFrom Apache Kafka 4.2.2, 4.3.1, and 4.4.0: a broker that would fall back to the\u00a0non-verifying ClientJwtValidator fails to start with a ConfigException instead of running\u00a0without signature verification (secure by default).", "A flaw was found in Apache Kafka. When configured to use token-based authentication without a remote key validation endpoint, the broker falls back to an internal validator that does not check JSON Web Token (JWT) signatures, algorithms, or issuers. An unauthenticated remote attacker can exploit this vulnerability by submitting a forged token asserting any identity, allowing them to bypass authentication and gain full unauthorized access to the cluster."], "mitigation": {"lang": "en:us", "value": "Red Hat is not aware of any available mitigation for this issue. Customers are advised to apply the relevant security updates as they become available."}, "name": "CVE-2026-110985", "package_state": [{"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Not affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Not affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Not affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "kafka-clients", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "kafka-clients", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Not affected", "package_name": "kafka-clients", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-10-28T16:37:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110985\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110985\nhttps://kafka.apache.org/cve-list"], "statement": "This vulnerability is rated as Important because an unauthenticated attacker who can reach a Kafka broker listener configured for SASL/OAUTHBEARER without a JWKS endpoint or custom key resolver can forge a JWT and impersonate any principal, including superusers.\nRed Hat products are not affected by this flaw. The issue is limited to the Apache Kafka broker's default JWT validator path. Offerings that ship only kafka-clients libraries or use Kafka solely as a producer or consumer (including OpenShift Serverless kn-ekb components) do not perform this broker-side token acceptance. AMQ Streams versions matched for this flaw ship Kafka 4.0.x, which is outside the upstream affected range (4.1.0 and later). Deployments using other SASL mechanisms or mTLS-only authentication are also not impacted.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Kafka", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kafka", "vendor": "apache"}], "created": "2026-10-28T17:30:15.427697+00:00", "updated": "2026-10-30T13:30:12.683043+00:00", "vendors": ["apache", "apache$PRODUCT$kafka"]}