CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer (iss) claim is verified only when sasl.oauthbearer.expected.issuer is set. When it is unset, a validly-signed token carrying the expected audience is accepted regardless of which issuer minted it. - An audience (aud) claim is required only when sasl.oauthbearer.expected.audience is set. When it is unset, a validly-signed token that omits the aud claim is accepted. (A token that carries an aud claim is still rejected when no expected audience is configured.) Both options default to unset and have been documented as optional (Importance LOW) since KIP-768 (3.1.0). Impact: The exposure is realizable mainly in deployments whose JWKS endpoint serves signing keys for more than one issuer (a multi-tenant identity provider, an aggregated/shared JWKS, or shared signing keys): a token minted for a different issuer, or a token lacking an audience, may be accepted to authenticate — potentially as a higher-privileged principal. In a single-issuer deployment where the provider controls the iss claim and issues audience-scoped tokens, exposure is limited. The signature trust anchor remains enforced in all cases. This is distinct from CVE-2026-33557 (acceptance of unsigned/unvalidated tokens); here the signature is validated and only the issuer/audience checks are not enforced by default. Mitigation (all affected versions, no upgrade required): Set both sasl.oauthbearer.expected.issuer (to your provider's exact iss value) and sasl.oauthbearer.expected.audience (to the audience(s) your brokers expect), per listener. Brokers that set these perform exact-match issuer/audience checks and are not affected. Both have been available since 3.1.0. Resolution: - From Apache Kafka 4.4.0: a broker configured with a JWKS endpoint fails to start unless both sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience are set (secure by default). Deployments that intentionally do not restrict the issuer and/or audience may opt out per axis with sasl.oauthbearer.allow.unverified.issuer=true and/or sasl.oauthbearer.allow.unverified.audience=true.

• CWE-345
• CWE-1188

• https://kafka.apache.org/cve-list

Published

Oct 28, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110935The PFI plugin framework deployment routine does not validat…8.4
• CVE-2026-110936A vulnerability has been identified in Siemens Software Cent…6.7
• CVE-2026-110938In Eclipse OpenJ9 versions up to 0.63.0, the JITServer compo…8.7
• CVE-2026-11094Use after free in Codecs in Google Chrome on Windows prior t…9.6
• CVE-2026-110944Resource exhaustion vulnerability in the HTTP request handli…2.7
• CVE-2026-11095Insufficient validation of untrusted input in Codecs in Goog…9.6
• CVE-2026-110956The asVereinbase WordPress plugin before 1.1.8 does not req…9.8
• CVE-2026-110957A vulnerability has been found in Wavlink WL-WN530BE2-A up t…10
• CVE-2026-110958A vulnerability was found in Wavlink WN530HG4B M30HG4B_V2607…10
• CVE-2026-11096Out of bounds read in WebRTC in Google Chrome prior to 149.0…6.5
• CVE-2026-110964The Essential Real Estate WordPress plugin before 5.3.5 does…6.5
• CVE-2026-11097Inappropriate implementation in WebView in Google Chrome on …6.5