CVE-2026-33557

Katalog CVE

CVSS 9.1 · Critical EPSS 0,93%

Kerentanan Improper Validation of Specified Index, Position, or Offset in Input pada apache kafka. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

Rincian

Terbit di NVD

20 April 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
CWE-303: Incorrect Implementation of Authentication Algorithm

EPSS (30 hari)

0,93% peluang dieksploitasi; lebih tinggi dari 59,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kafka.apache.org/cve-list advisory vendor
• https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h mitigasi · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/17/2 mailing list
• https://access.redhat.com/security/cve/CVE-2026-33557
• https://bugzilla.redhat.com/show_bug.cgi?id=2459739
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.json