Bug 2562962 (CVE-2026-110985)

Summary:	CVE-2026-110985 org.apache.kafka/kafka-clients: Apache Kafka: Authentication bypass via missing JWT signature verification
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ant, asyoung, ccranfor, cescoffi, chfoley, cmah, dhanak, drosa, dsimansk, ewittman, fmariani, fmongiar, gmalinko, gsmet, gtanzill, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpechane, jturenov, jwon, kaycoth, kingland, manderse, mcarlett, mnovotny, nipatil, olubyans, ozzy, pantinor, pdelbell, pjindal, prichard, rguimara, rhel-process-autobot, rkubis, rstepani, sausingh, sbiarozk, sthirugn, swoodman, tcunning, varjain, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache Kafka. When configured to use token-based authentication without a remote key validation endpoint, the broker falls back to an internal validator that does not check JSON Web Token (JWT) signatures, algorithms, or issuers. An unauthenticated remote attacker can exploit this vulnerability by submitting a forged token asserting any identity, allowing them to bypass authentication and gain full unauthorized access to the cluster.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-28 16:55:28 UTC

A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset (the default) and no verification key resolver is supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not verify the JWT signature, algorithm, or issuer - and the broker starts with no warning or error. This is the residual of CVE-2026-33557, whose fix restored signature verification only on the path where the JWKS endpoint URL is set.

Impact:

A broker in this state accepts any structurally valid JWT, including "alg":"none" tokens. An unauthenticated remote attacker who can reach the listener can forge a token asserting any principal - including configured superusers - and gain full access to the cluster. Only brokers that enable SASL/OAUTHBEARER validation without a JWKS endpoint URL (and without a custom verification key resolver) are affected; brokers that set the URL verify signatures and are not affected. Unlike CVE-2026-110952 (issuer/audience not enforced by default), here no signature is verified at all.

Mitigation (all affected versions, no upgrade required):

Set sasl.oauthbearer.jwks.endpoint.url for every listener/mechanism that uses OAuthBearerValidatorCallbackHandler, or configure a signature-verifying sasl.oauthbearer.jwt.validator.class.

Resolution:

From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: a broker that would fall back to the non-verifying ClientJwtValidator fails to start with a ConfigException instead of running without signature verification (secure by default).