CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
Apache Kafka accepts unsigned JWT tokens by default, allowing attackers to impersonate any user and bypass authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33557?
CVE-2026-33557 is a critical authentication bypass vulnerability in Apache Kafka, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A possible security vulnerability has been identified in Apache Kafka.
By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.
We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
Which versions are affected by CVE-2026-33557?
3 open source packages ship an affected version, including org.apache.kafka:kafka-clients and kafka. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.kafka:kafka-clients Maven | From 4.1.0 | 4.1.2 |
org.apache.kafka:kafka-clients Maven | From 4.1.0 | 4.1.2 |
kafka Bitnami | From 4.1.0 | 4.1.2 |
Products include Apache Kafka.
How do I fix CVE-2026-33557?
Upgrade org.apache.kafka:kafka-clients to 4.1.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-33557 being exploited?
There is no known exploitation of CVE-2026-33557 in the wild and no public exploit code.
Other vulnerabilities in Apache Kafka
- CVE-2025-27818 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration
- CVE-2018-17196 Improper Input Validation in Apache Kafka
- CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
- CVE-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability
- CVE-2025-27819 Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration
Sources
Also known as BIT-kafka-2026-33557, CLEANSTART-2026-AD78101, ECHO-0295-5664-07c7, GHSA-28jg-cgg7-j4wc, MINI-52p4-fv3h-m2c7, MINI-59xj-jqx3-j4cp and 8 more.