Kafka OAuth JWT issuer and audience checks off by default (CVE-2026-110952)
Original title: CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
The bundled JWKS validator always checks the signature, but iss and audience checks need explicit settings.
An oss-security post rates CVE-2026-110952 moderate. Kafka brokers authenticating clients with SASL/OAUTHBEARER and the bundled JWKS-backed validator always verify the JWT signature. Issuer (iss) validation runs only when sasl.oauthbearer.expected.issuer is set; a second check is likewise only performed when configured. Affected versions are Apache Kafka 3.1.0 before 4.4.0. The visible text cuts off while describing an unset issuer.
Unconfirmed: The snippet does not fully describe the audience setting or confirm a fix.
- Severity is listed as moderate.
- The affected range is 3.1.0 before 4.4.0.
- Issuer validation depends on sasl.oauthbearer.expected.issuer.
- Signature verification still always occurs, the post says.
Impact: Issuer and audience not enforced unless explicitly configured
| Product | Affected |
|---|---|
| Apache Kafka | 3.1.0 before 4.4.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110952 | Optional JWT issuer/audience checks in Kafka SASL/OAUTHBEARER | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 3. 1. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.