A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access (Apache Kafka)). Supported versions that are affected are     21.12.0.0-21.12.21.8, 22.12.0.0-22.12.21.2, 23.12.0-23.12.19, 24.12.0-24.12.14 and 25.12.0-25.12.4. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all Primavera P6 Enterprise     Project Portfolio Management accessible data as well as unauthorized access to critical data or complete     access to all Primavera P6 Enterprise Project Portfolio Management accessible data. (CVE-2026-33557)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A possible security vulnerability has been identified in Apache Kafka. By default, the broker property
    `sasl.oauthbearer.jwt.validator.class` is set to
    `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without
    validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with
    the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using
    kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to
    `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability.
    Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
    (CVE-2026-33557)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A possible security vulnerability has been identified in Apache Kafka. By default, the broker property     `sasl.oauthbearer.jwt.validator.class` is set to     `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without     validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with     the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using     kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to     `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability.
    Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
    (CVE-2026-33557)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
329221	Oracle Primavera P6 Enterprise Project Portfolio Management (July 2026 CPU)	Nessus	CGI abuses	Remote	high
440825	SCA: security update for org.apache.kafka:kafka-clients (GHSA-28jg-cgg7-j4wc)	Tenable Cloud Security	SCA Checks	Local	high
440825	SCA: security update for org.apache.kafka:kafka-clients (GHSA-28jg-cgg7-j4wc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
308163	Linux Distros Unpatched Vulnerability : CVE-2026-33557	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-33557

high

Tenable Plugins

high

high

high

critical