Junglewise Threat Intelligence

CVE-2026-33557: Apache Kafka authentication bypass via improper JWT validation

CVE-2026-33557 · Severity: critical · CVSS 9.1 · Published 2026-04-20

Technologies: Red Hat Streams for Apache Kafka, Red Hat build of Debezium. Vendors: Red Hat, Maven, Apache.

Executive brief

Apache Kafka, a widely used platform for handling real-time data streams, contains a security flaw that allows unauthorized users to bypass authentication. By default, the system fails to verify the digital signatures of security tokens, meaning an attacker can impersonate any user and gain access to the data stream. This could lead to unauthorized access to sensitive business information or the injection of fraudulent data into corporate systems.

Technical details

Apache Kafka versions 4.1.0 and 4.1.1 are vulnerable to an authentication bypass due to an improper implementation of the OAUTHBEARER authentication mechanism. By default, the broker uses 'DefaultJwtValidator', which fails to validate the JWT signature, issuer, or audience. A remote, unauthenticated attacker can craft a malicious JWT with a chosen 'preferred_username' and gain unauthorized access to the Kafka broker. The issue is resolved in versions 4.1.2 and 4.2.0; users on affected versions can mitigate the risk by manually switching the validator class to 'BrokerJwtValidator'.

Affected products

  • Apache Kafka 4.1.0, 4.1.1
  • Red Hat Red Hat build of Debezium 3 affected
  • Red Hat streams for Apache Kafka 3 affected

Timeline

  • 2026-04-17: disclosed: Initial disclosure on oss-security mailing list
  • 2026-04-20: advisory: NVD and Red Hat advisories published
  • 2026-04-20: patched: Fixes identified in Kafka 4.1.2 and 4.2.0

References

Related threats