Kafka skips JWT signature checks when JWKS URL is unset (CVE-2026-110985)
Original title: CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
DefaultJwtValidator verifies signatures only if sasl.oauthbearer.jwks.endpoint.url is set; that setting is unset by default.
An oss-security post rates CVE-2026-110985 important for Apache Kafka brokers using SASL/OAUTHBEARER with DefaultJwtValidator. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset, which is the default, the snippet says the broker does not perform that check. Affected versions are 4.1.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0. The post is truncated before remediation details.
Unconfirmed: The truncated post does not state a fixed release or known exploitation.
- Severity is listed as important.
- The validator class named is DefaultJwtValidator.
- JWKS URL configuration selects whether signature verification runs.
- Listed ranges stop at 4.1.2, 4.2.1, and 4.3.0.
Impact: JWT signatures skipped when the JWKS endpoint URL is unset
| Product | Affected |
|---|---|
| Apache Kafka | 4.1.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110985 | Unverified JWT acceptance in Kafka SASL/OAUTHBEARER without JWKS URL | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 4. 1. 0 through 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.