CVE-2026-110952

Overview

Apache Kafka is an open-source distributed event streaming platform used for high-throughput, fault-tolerant data pipelines and stream processing. It stores records in partitioned, replicated, append-only logs on a cluster of brokers, and exposes producer, consumer, admin, Streams, and Connect APIs for publishing, subscribing to, and processing those records. The Java client and server components are published as Maven artifacts under org.apache.kafka.

An incorrectly configured access control vulnerability (CVE-2026-110952) has been identified in the JWKS-backed SASL/OAUTHBEARER validator that Apache Kafka brokers use to authenticate clients, which allows attackers to authenticate with a validly signed JWT that was minted by a different issuer or that carries no audience claim. Where the JWKS endpoint serves signing keys for more than one issuer, such a token may authenticate the attacker as a higher-privileged principal.

Per OWASP: Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.

This issue affects multiple versions of Apache Kafka.

Details

Module Info

• Product: Apache Kafka
• Affected packages: org.apache.kafka:kafka-clients
• Affected versions: >=3.1.0 <4.4.0
• GitHub repository: https://github.com/apache/kafka
• Published packages: https://central.sonatype.com/artifact/org.apache.kafka/kafka-clients
• Package manager: Maven
• Fixed in:
  • OSS Apache Kafka 4.4.0
  • NES for Apache Kafka v3.1.5

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.kafka:kafka-clients package in multiple versions of Apache Kafka. When a broker listener authenticates SASL/OAUTHBEARER clients against a JWKS endpoint, the broker always verifies the JWT signature, but it checks the token's issuer and audience only when the operator has set sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience. Both settings are defined with a null default and LOW importance, and the validator factory reads them as optional values without requiring either one:

.define(SaslConfigs.SASL_OAUTHBEARER_EXPECTED_AUDIENCE, ConfigDef.Type.LIST, null, ConfigDef.Importance.LOW, SASL_OAUTHBEARER_EXPECTED_AUDIENCE_DOC)
.define(SaslConfigs.SASL_OAUTHBEARER_EXPECTED_ISSUER, ConfigDef.Type.STRING, null, ConfigDef.Importance.LOW, SASL_OAUTHBEARER_EXPECTED_ISSUER_DOC);

The validator then passes the expected values to its jose4j JwtConsumerBuilder only when they are present:

if (expectedAudiences != null && !expectedAudiences.isEmpty())
    jwtConsumerBuilder.setExpectedAudience(expectedAudiences.toArray(new String[0]));

if (expectedIssuer != null)
    jwtConsumerBuilder.setExpectedIssuer(expectedIssuer);

With sasl.oauthbearer.expected.issuer unset, no expected issuer is registered, so the iss claim is never compared and a validly signed token from any issuer is accepted. With sasl.oauthbearer.expected.audience unset, no audience is required, so a validly signed token that omits the aud claim is accepted (a token that carries an aud claim is still rejected in that case). An attacker who holds a token signed by a key the broker's JWKS endpoint trusts, but issued for another tenant, another issuer or another service, can therefore authenticate to the broker as the token's subject. The exposure is greatest where the JWKS endpoint serves keys for more than one issuer, such as a multi-tenant identity provider, an aggregated JWKS or shared signing keys.

Mitigation

Only recent versions of Apache Kafka are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. The Apache Kafka project does bugfix releases only for the last three minor releases; see the project's time-based release plan.

On every affected version, brokers that set both options to the exact values their identity provider issues perform exact-match issuer and audience checks and are not affected. Set them for each listener that uses SASL/OAUTHBEARER with a JWKS endpoint, for example:

listener.name.sasl_ssl.oauthbearer.sasl.oauthbearer.expected.issuer=https://idp.example.com/
listener.name.sasl_ssl.oauthbearer.sasl.oauthbearer.expected.audience=kafka-cluster

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Kafka to a currently supported release that contains the fix, such as 4.4.0.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Kai Aizen from SnailSploit (finder)