# CVE-2026-33557: Apache Kafka authentication bypass via improper JWT validation

Source: https://junglewise.ai/threats/cve-2026-33557-apache-kafka-authentication-bypass-via-improper-jwt-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33557 · Severity: critical · CVSS 9.1 · Published 2026-04-20

Apache Kafka, a widely used platform for handling real-time data streams, contains a security flaw that allows unauthorized users to bypass authentication. By default, the system fails to verify the digital signatures of security tokens, meaning an attacker can impersonate any user and gain access to the data stream. This could lead to unauthorized access to sensitive business information or the injection of fraudulent data into corporate systems.

Technologies: [Apache Kafka](https://junglewise.ai/threats/technologies/kafka), [org.apache.kafka:kafka-clients (Maven)](https://junglewise.ai/threats/technologies/org-apache-kafka-kafka-clients), [Red Hat build of Debezium](https://junglewise.ai/threats/technologies/build-of-debezium), [Red Hat Streams for Apache Kafka](https://junglewise.ai/threats/technologies/streams-for-apache-kafka). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-33557 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33557 being exploited in the wild.

**How severe is CVE-2026-33557?** Critical severity, with a CVSS score of 9.1, published 20 April 2026.

**Which products and versions are affected?** org.apache.kafka:kafka-clients (Maven) >= 4.1.0, < 4.1.2, ECOSYSTEM:introduced=4.1.0,fixed=4.1.2; Red Hat build of Debezium affected; Red Hat Streams for Apache Kafka affected.

**Is there a fix for CVE-2026-33557?** Yes. org.apache.kafka:kafka-clients (Maven): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33557 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33557?** Check whether you run Apache Kafka, org.apache.kafka:kafka-clients (Maven), Red Hat build of Debezium or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.kafka:kafka-clients (Maven): upgrade to 4.1.2 or later

  ```sh
  # set org.apache.kafka:kafka-clients to 4.1.2 in your pom.xml or build.gradle
  ```


## Technical details

Apache Kafka versions 4.1.0 and 4.1.1 are vulnerable to an authentication bypass due to an improper implementation of the OAUTHBEARER authentication mechanism. By default, the broker uses 'DefaultJwtValidator', which fails to validate the JWT signature, issuer, or audience. A remote, unauthenticated attacker can craft a malicious JWT with a chosen 'preferred_username' and gain unauthorized access to the Kafka broker. The issue is resolved in versions 4.1.2 and 4.2.0; users on affected versions can mitigate the risk by manually switching the validator class to 'BrokerJwtValidator'.

## Affected products

- Apache Kafka 4.1.0, 4.1.1
- Red Hat Red Hat build of Debezium 3 affected
- Red Hat streams for Apache Kafka 3 affected

## Identifiers

- CVE-2026-33557
- GHSA-28jg-cgg7-j4wc

## Timeline

- 2026-04-17: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-20: advisory: NVD and Red Hat advisories published
- 2026-04-20: patched: Fixes identified in Kafka 4.1.2 and 4.2.0

## References

- [https://kafka.apache.org/cve-list](https://kafka.apache.org/cve-list)
- [https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h](https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h)
- [http://www.openwall.com/lists/oss-security/2026/04/17/2](http://www.openwall.com/lists/oss-security/2026/04/17/2)
- [https://access.redhat.com/security/cve/CVE-2026-33557](https://access.redhat.com/security/cve/CVE-2026-33557)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2459739](https://bugzilla.redhat.com/show_bug.cgi?id=2459739)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.json)

## Related threats

- [Apache Kafka incorrect operator in FetchSnapshot RPC handler](https://junglewise.ai/threats/cve-2026-83525-incorrect-operator-cwe-480-in-the-fetchsnapshot-rpc-handler-in)
- [Apache Kafka memory exhaustion in compressed record batch decoding](https://junglewise.ai/threats/cve-2026-114349-when-a-broker-decodes-a-compressed-record-batch-the-per-record)
- [Apache Kafka information disclosure via ConfigProvider in AlterConfigs](https://junglewise.ai/threats/cve-2026-112375-an-authenticated-kafka-principal-with-no-authorization-grants)
- [Apache Kafka deserialization denial of service via oversized allocation](https://junglewise.ai/threats/cve-2026-111551-several-kafka-deserialization-paths-read-a-size-or-count-field)
- [Apache Kafka unbounded tagged-field allocation in flexible protocol headers](https://junglewise.ai/threats/cve-2026-111115-apache-kafka-s-code-generated-readers-for-flexible-protocol)