CVE-2026-110952

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 4.4.0

Description A Kafka broker using the bundled JWKS-backed validator for SASL/OAUTHBEARER authentication verifies JWT signatures but does not enforce issuer and audience checks by default. Specifically, the issuer (iss) claim is only verified if sasl.oauthbearer.expected.issuer is configured, and the audience (aud) claim is only required if sasl.oauthbearer.expected.audience is configured. In multi-tenant environments or deployments with shared JWKS endpoints, this may allow a token from a different issuer or one lacking an audience to be accepted, potentially granting access as a higher-privileged principal.

Recommendations Update to Apache Kafka version 4.4.0 or later. As a temporary mitigation for versions prior to 4.4.0, set both sasl.oauthbearer.expected.issuer to the provider's exact issuer value and sasl.oauthbearer.expected.audience to the expected audience per listener.