Apache Kafka Fixes 12 Vulnerabilities, Including a JWT Bypass That Grants Full Cluster Access
Do Son 
TL;DR
The Apache Kafka project disclosed 12 Apache Kafka vulnerabilities. The most serious, CVE-2026-110985, lets an unauthenticated attacker forge a login token and “gain full access to the cluster.” Kafka rates six of the flaws Important, three Moderate and three Low.
The bugs enable authentication bypass, secret theft and memory-exhaustion crashes. Fixes ship in Kafka 4.2.2, 4.3.2 and 4.4.0. However, two fixes also need new configuration settings to fully protect brokers.
- Total: 12 CVEs
- Severity: 12 Unrated
- Actively exploited: None confirmed
- Highest severity: Awaiting analysis — CVE-2026-110985
- Action: Apply the latest security updates now
Notable CVEs
| CVE | Type | Fixed in | Status |
|---|---|---|---|
| CVE-2026-110985 | CWE-345 | — | Not exploited |
| CVE-2026-112375 | CWE-862 | — | Not exploited |
| CVE-2026-114349 | CWE-400 | — | Not exploited |
| CVE-2026-111108 | CWE-400 | — | Not exploited |
| CVE-2026-111115 | Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing | — | Not exploited |
| CVE-2026-111551 | CWE-20 | — | Not exploited |
| CVE-2026-116593 | Kafka Connect configuration provider values exposed via validation REST API endpoint | 4.2.2, 4.3.2 | Not exploited |
| CVE-2026-111073 | CWE-400 | — | Not exploited |
Why It Matters
Kafka moves data between many systems, so a broken broker can stall entire pipelines. Moreover, several flaws expose credentials or bypass logins, which could hand attackers the whole data stream.
How the Attack Works
JWT signature verification skipped
CVE-2026-110985 hits brokers using SASL/OAUTHBEARER without a JWKS endpoint URL. In that setup, the broker “silently falls back” to a validator that skips JWT signature verification. As a result, an attacker can forge a token for any user, “including configured superusers.” A related bug, CVE-2026-110952, skips issuer and audience checks unless admins set them.
Secret exposure
CVE-2026-112375 lets an authenticated user with no grants read broker files and environment variables. It also bypasses the allowlist added for CVE-2024-31141. Similarly, CVE-2026-116593 lets anyone who can reach a Connect validation endpoint pull hidden configuration values in plaintext.
Denial of service
Five bugs let crafted requests or records force huge memory allocations. For example, a roughly 90-byte compressed request can trigger a 2 GiB allocation under CVE-2026-114349. Other flaws stall Kafka Streams threads or crash the KRaft controller.
Affected Versions
Ranges differ by bug, but most of these Apache Kafka vulnerabilities affect all releases before 4.2.2 and 4.3.x before 4.3.2. Users on 4.1.x or older should move to a supported branch.
Patch and Mitigation
Upgrade to Kafka 4.2.2, 4.3.2 or 4.4.0. Then take these extra steps:
- Set sasl.oauthbearer.jwks.endpoint.url on every OAUTHBEARER listener. This fixes JWT signature verification without an upgrade.
- Set the expected issuer and audience values.
- Set max.decompressed.message.bytes to a bounded value. Kafka warns that “upgrading alone is not sufficient,” since the default is about 2 GiB.
- Remove admin.listeners in Kafka Connect if you cannot patch yet.
Until then, restrict Write access and Connect REST endpoints to trusted clients. So far, no exploitation of these Apache Kafka vulnerabilities has been reported.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
