CVE detail
CVE-2026-33557
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 16.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comApr 20, 2026, 2:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2459739bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comApr 20, 2026, 2:16 PM - https://access.redhat.com/security/cve/CVE-2026-33557access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 20, 2026, 2:16 PM - http://www.openwall.com/lists/oss-security/2026/04/17/2www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 20, 2026, 2:16 PM - https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953hlists.apache.org
No excerpt available.
Vendor Advisorylists.apache.orgApr 20, 2026, 2:16 PM - https://kafka.apache.org/cve-listkafka.apache.org
No excerpt available.
Vendor Advisorykafka.apache.orgApr 20, 2026, 2:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2024-56128CVSS 5.3 · Medium
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authent…
- CVE-2026-66028CVSS 7.1 · High
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts…
- CVE-2026-57852CVSS 6.3 · Medium
Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a…
- CVE-2026-47300CVSS 8.8 · High
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50360CVSS 8.8 · High
Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-41053CVSS 8.8 · High
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13…