# CVE-2026-110952: Apache Kafka SASL/OAUTHBEARER issuer and audience validation bypass

Source: https://junglewise.ai/threats/cve-2026-110952-a-kafka-broker-that-authenticates-clients-with-sasl-oauthbearer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-110952 · Severity: info · Published 2026-10-28

Apache Kafka brokers using SASL/OAUTHBEARER authentication with JWKS do not enforce issuer and audience checks by default, even though JWT signatures are validated. In multi-tenant or shared identity provider deployments, this allows tokens issued for different purposes or issuers to be accepted as valid, potentially granting unauthorized access. Single-issuer deployments with audience-scoped tokens face limited exposure.

Technologies: [Apache Kafka](https://junglewise.ai/threats/technologies/kafka). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-110952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110952 being exploited in the wild.

**How severe is CVE-2026-110952?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Apache Kafka 3.1.0 through 4.3.x.

**Is there a fix for CVE-2026-110952?** Yes: fixed in Apache Kafka 4.4.0 and later (now required by default; can be opted out per axis with sasl.oauthbearer.allow.unverified.issuer or sasl.oauthbearer.allow.unverified.audience). Until then: Set both sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience configuration options per listener to enforce exact-match validation. These options have been available since Kafka 3.1.0 and are the recommended remediation for all affected versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110952 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-110952?** Check whether you run Apache Kafka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache Kafka 4.4.0 and later (now required by default; can be opted out per axis with sasl.oauthbearer.allow.unverified.issuer or sasl.oauthbearer.allow.unverified.audience)

Set both sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience configuration options per listener to enforce exact-match validation. These options have been available since Kafka 3.1.0 and are the recommended remediation for all affected versions.

## Technical details

The Kafka JWKS-backed SASL/OAUTHBEARER validator verifies JWT signatures but only enforces issuer (iss claim) and audience (aud claim) validation when explicitly configured via sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience. This allows acceptance of validly-signed tokens from unintended issuers or without expected audience claims. The vulnerability is most severe in multi-tenant JWKS endpoints or shared signing key scenarios where tokens intended for different systems or principals could be accepted.

## Affected products

- Apache Kafka 3.1.0 through 4.3.x

## Timeline

- 2026-10-28: disclosed

## Related threats

- [Apache Kafka incorrect operator in FetchSnapshot RPC handler](https://junglewise.ai/threats/cve-2026-83525-incorrect-operator-cwe-480-in-the-fetchsnapshot-rpc-handler-in)
- [Apache Kafka memory exhaustion in compressed record batch decoding](https://junglewise.ai/threats/cve-2026-114349-when-a-broker-decodes-a-compressed-record-batch-the-per-record)
- [Apache Kafka information disclosure via ConfigProvider in AlterConfigs](https://junglewise.ai/threats/cve-2026-112375-an-authenticated-kafka-principal-with-no-authorization-grants)
- [Apache Kafka deserialization denial of service via oversized allocation](https://junglewise.ai/threats/cve-2026-111551-several-kafka-deserialization-paths-read-a-size-or-count-field)
- [Apache Kafka unbounded tagged-field allocation in flexible protocol headers](https://junglewise.ai/threats/cve-2026-111115-apache-kafka-s-code-generated-readers-for-flexible-protocol)