Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110985— Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

Quick assessment

Affected
Apache Software Foundation Apache Kafka
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在使用 SASL/OAUTHBEARER 机制并采用默认验证器（ ）的 Kafka Broker，其具体实现是根据配置动态选择的。当配置了 时，验证器会对 JWT 的签名进行校验；然而，若该 URL 未设置（即保持默认状态）且未提供自定义的验证密钥解析器， 会静默回退到 。该回退验证器不会对 JWT 的签名、算法或签发者（issuer）进行任何校验，且 Broker 启动时不会发出任何警告或错误。这是 CVE-2026-33557 的遗留问题：该漏洞的修复仅恢复了在设置了 JWKS 端点 URL 路径下的签名验证，

AI Predicted 9.8 Difficulty: Trivial

Affected Version Matrix 3

VendorProduct Version RangeStatus
Apache Software Foundation Apache Kafka 4.1.0≤ 4.1.2 affected
4.2.0≤ 4.2.1 affected
4.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110985

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Source: CVE Program / CVE List V5
Vulnerability Description
A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset (the default) and no verification key resolver is supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not verify the JWT signature, algorithm, or issuer - and the broker starts with no warning or error. This is the residual of CVE-2026-33557, whose fix restored signature verification only on the path where the JWKS endpoint URL is set. Impact: A broker in this state accepts any structurally valid JWT, including "alg":"none" tokens. An unauthenticated remote attacker who can reach the listener can forge a token asserting any principal - including configured superusers - and gain full access to the cluster. Only brokers that enable SASL/OAUTHBEARER validation without a JWKS endpoint URL (and without a custom verification key resolver) are affected; brokers that set the URL verify signatures and are not affected. Unlike CVE-2026-110952 (issuer/audience not enforced by default), here no signature is verified at all. Mitigation (all affected versions, no upgrade required): Set sasl.oauthbearer.jwks.endpoint.url for every listener/mechanism that uses OAuthBearerValidatorCallbackHandler, or configure a signature-verifying sasl.oauthbearer.jwt.validator.class. Resolution: From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: a broker that would fall back to the non-verifying ClientJwtValidator fails to start with a ConfigException instead of running without signature verification (secure by default).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Kafka 4.1.0 ~ 4.1.2 -

II. Public POCs for CVE-2026-110985

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110985

请登录查看更多情报信息。

Same Patch Batch · Apache Software Foundation · 2026-10-28 · 12 CVEs total

CVE-2026-114349 Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed r
CVE-2026-112375 Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterC
CVE-2026-116593 Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API
CVE-2026-115644 Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
CVE-2026-111551 Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded me
CVE-2026-111496 Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctua
CVE-2026-111115 Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexibl
CVE-2026-111108 Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated
CVE-2026-111073 Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size lim
CVE-2026-110952 Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEA
CVE-2026-83525 Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated

IV. Related Vulnerabilities

Same product: Apache Kafka
Same vendor: Apache Software Foundation
Same weakness: CWE-345