A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A possible security vulnerability has been identified in Apache Kafka. By default, the broker property
    `sasl.oauthbearer.jwt.validator.class` is set to
    `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without
    validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with
    the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using
    kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to
    `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability.
    Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
    (CVE-2026-33557)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A possible security vulnerability has been identified in Apache Kafka. By default, the broker property     `sasl.oauthbearer.jwt.validator.class` is set to     `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without     validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with     the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using     kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to     `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability.
    Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
    (CVE-2026-33557)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
440825	SCA: security update for org.apache.kafka:kafka-clients (GHSA-28jg-cgg7-j4wc)	Tenable Cloud Security	SCA Checks	high
440825	SCA: security update for org.apache.kafka:kafka-clients (GHSA-28jg-cgg7-j4wc)	Tenable Self-Hosted Container Security	SCA Checks	high
308163	Linux Distros Unpatched Vulnerability : CVE-2026-33557	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-33557

high

Tenable Plugins

high

high

critical