529 lines
25 KiB
JSON
529 lines
25 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-33557",
|
||
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "apache",
|
||
"dateReserved": "2026-03-23T03:14:53.527Z",
|
||
"datePublished": "2026-04-20T13:28:43.669Z",
|
||
"dateUpdated": "2026-07-15T01:06:14.162Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Apache Kafka",
|
||
"vendor": "Apache Software Foundation",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "4.1.1",
|
||
"status": "affected",
|
||
"version": "4.1.0",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Павел Романов <promanov1994@gmail.com>"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<div>A possible security vulnerability has been identified in Apache Kafka.</div><div>By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.</div><div>We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.</div><br>"
|
||
}
|
||
],
|
||
"value": "A possible security vulnerability has been identified in Apache Kafka.\n\nBy default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.\n\nWe advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"content": {
|
||
"text": "important"
|
||
},
|
||
"type": "Textual description of severity"
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-1285",
|
||
"description": "CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||
"shortName": "apache",
|
||
"dateUpdated": "2026-04-20T13:28:43.669Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://kafka.apache.org/cve-list"
|
||
},
|
||
{
|
||
"tags": [
|
||
"mailing-list"
|
||
],
|
||
"url": "https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": "Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "http://www.openwall.com/lists/oss-security/2026/04/17/2"
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2026-04-20T13:38:51.117Z"
|
||
}
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 9.1,
|
||
"attackVector": "NETWORK",
|
||
"baseSeverity": "CRITICAL",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"integrityImpact": "HIGH",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "NONE",
|
||
"privilegesRequired": "NONE",
|
||
"confidentialityImpact": "HIGH"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-04-20T14:29:31.424817Z",
|
||
"id": "CVE-2026-33557",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-04-20T14:30:30.936Z"
|
||
}
|
||
},
|
||
{
|
||
"affected": [
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:serverless:1"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
|
||
"product": "OpenShift Serverless",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:serverless:1"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
|
||
"product": "OpenShift Serverless",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:camel_quarkus:3"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:camel_spring_boot:4"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat build of Apache Camel for Spring Boot 4",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:camel_spring_boot:4"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat build of Apache Camel for Spring Boot 4",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:service_registry:2"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat build of Apicurio Registry 2",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:apicurio_registry:3"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat build of Apicurio Registry 3",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:debezium:2"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat build of Debezium 2",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:debezium:3"
|
||
],
|
||
"defaultStatus": "affected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat build of Debezium 3",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:quarkus:3"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat build of Quarkus",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_data_grid:8"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat Data Grid 8",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_data_grid:8"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat Data Grid 8",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/o:redhat:enterprise_linux:8"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "log4j:2/log4j",
|
||
"product": "Red Hat Enterprise Linux 8",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/o:redhat:enterprise_linux:9"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "log4j",
|
||
"product": "Red Hat Enterprise Linux 9",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_fuse:7"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat Fuse 7",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_fuse:7"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat Fuse 7",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat JBoss Enterprise Application Platform 7",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat JBoss Enterprise Application Platform 7",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat JBoss Enterprise Application Platform 8",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat JBoss Enterprise Application Platform 8",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jbosseapxp"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jbosseapxp"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "Red Hat Process Automation 7",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:amq_streams:2"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "connect-api",
|
||
"product": "streams for Apache Kafka 2",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:amq_streams:2"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "kafka-clients",
|
||
"product": "streams for Apache Kafka 2",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:amq_streams:3"
|
||
],
|
||
"defaultStatus": "affected",
|
||
"packageName": "connect-api",
|
||
"product": "streams for Apache Kafka 3",
|
||
"vendor": "Red Hat"
|
||
},
|
||
{
|
||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||
"cpes": [
|
||
"cpe:/a:redhat:amq_streams:3"
|
||
],
|
||
"defaultStatus": "affected",
|
||
"packageName": "kafka-clients",
|
||
"product": "streams for Apache Kafka 3",
|
||
"vendor": "Red Hat"
|
||
}
|
||
],
|
||
"datePublic": "2026-04-20T13:28:43.669Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "A flaw was found in Apache Kafka. By default, the `sasl.oauthbearer.jwt.validator.class` property is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`, which does not validate JSON Web Token (JWT) signatures, issuers, or audiences. A remote attacker can exploit this by crafting a malicious JWT token with an arbitrary `preferred_username`, leading to an authentication bypass and unauthorized access to the Kafka broker."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"content": {
|
||
"namespace": "https://access.redhat.com/security/updates/classification/",
|
||
"value": "Important"
|
||
},
|
||
"type": "Red Hat severity rating"
|
||
}
|
||
},
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "LOW",
|
||
"baseScore": 8.6,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "LOW",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS"
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-303",
|
||
"description": "Incorrect Implementation of Authentication Algorithm",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vdb-entry",
|
||
"x_refsource_REDHAT"
|
||
],
|
||
"url": "https://access.redhat.com/security/cve/CVE-2026-33557"
|
||
},
|
||
{
|
||
"name": "RHBZ#2459739",
|
||
"tags": [
|
||
"issue-tracking",
|
||
"x_refsource_REDHAT"
|
||
],
|
||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459739"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_sadp-csaf-vex"
|
||
],
|
||
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33557.json"
|
||
}
|
||
],
|
||
"timeline": [
|
||
{
|
||
"lang": "en",
|
||
"time": "2026-04-20T14:01:07.601Z",
|
||
"value": "Reported to Red Hat."
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"time": "2026-04-20T13:28:43.669Z",
|
||
"value": "Made public."
|
||
}
|
||
],
|
||
"title": "kafka: Apache Kafka: Authentication bypass via improper JWT validation",
|
||
"x_adpType": "supplier",
|
||
"x_generator": {
|
||
"engine": "sadp-cli 1.0.0"
|
||
},
|
||
"providerMetadata": {
|
||
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
|
||
"shortName": "redhat-SADP",
|
||
"dateUpdated": "2026-07-15T01:06:14.162Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |