CVE-2026-110985
Description
A flaw was found in Apache Kafka. When configured to use token-based authentication without a remote key validation endpoint, the broker falls back to an internal validator that does not check JSON Web Token (JWT) signatures, algorithms, or issuers. An unauthenticated remote attacker can exploit this vulnerability by submitting a forged token asserting any identity, allowing them to bypass authentication and gain full unauthorized access to the cluster.
Statement
This vulnerability is rated as Important because an unauthenticated attacker who can reach a Kafka broker listener configured for SASL/OAUTHBEARER without a JWKS endpoint or custom key resolver can forge a JWT and impersonate any principal, including superusers.
Red Hat products are not affected by this flaw. The issue is limited to the Apache Kafka broker's default JWT validator path. Offerings that ship only kafka-clients libraries or use Kafka solely as a producer or consumer (including OpenShift Serverless kn-ekb components) do not perform this broker-side token acceptance. AMQ Streams versions matched for this flaw ship Kafka 4.0.x, which is outside the upstream affected range (4.1.0 and later). Deployments using other SASL mechanisms or mTLS-only authentication are also not impacted.
Mitigation
Red Hat is not aware of any available mitigation for this issue. Customers are advised to apply the relevant security updates as they become available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
