Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN402
_____________________________________________________________________

DATE                : 17/04/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Kafka.

=====================================================================
https://lists.apache.org/thread/zdv5ldd7n32s3qhrqzw82nn13mx9c0hd
https://lists.apache.org/thread/474oykc6ng3x9qmx6ztqtqdllnjlnksc
_____________________________________________________________________

CVE-2026-33557: Apache Kafka: Missing JWT token validation in
OAUTHBEARER authentication

Severity: important 

Affected versions:

- Apache Kafka 4.1.0 through 4.1.1

Description:

A possible security vulnerability has been identified in Apache Kafka.

By default, the broker property `sasl.oauthbearer.jwt.validator.class`
is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`.
It accepts any JWT token without validating its signature, issuer, or
audience. An attacker can generate a JWT token from any issuer with the
`preferred_username` set to any user, and the broker will accept it.

We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the
config `sasl.oauthbearer.jwt.validator.class` to
`org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator`
explicitly to avoid this vulnerability. Since Kafka v4.1.2 and
v4.2.0 and later, the issue is fixed and will correctly validate
the JWT token.

Credit:

Павел Романов <pr...@gmail.com> (finder)

References:

https://kafka.apache.org/cve-list
https://kafka.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-33557

_____________________________________________________________________

CVE-2026-33558: Apache Kafka, Apache Kafka Clients: Information
Exposure Through Network Client Log Output

Severity: moderate 

Affected versions:

- Apache Kafka 0.11.0 through 3.9.1
- Apache Kafka 4.0.0
- Apache Kafka Clients (org.apache.kafka:kafka-clients) 0.11.0 through
3.9.1
- Apache Kafka Clients (org.apache.kafka:kafka-clients) 4.0.0

Description:

Information exposure vulnerability has been identified in Apache Kafka.

The NetworkClient component will output entire requests and responses
information in the DEBUG log level in the logs. By default, the log
level is set to INFO level. If the DEBUG level is enabled, the
sensitive information will be exposed via the requests and responses
output log. The entire lists of impacted requests and responses are:


  *  AlterConfigsRequest

  *  AlterUserScramCredentialsRequest

  *  ExpireDelegationTokenRequest

  *  IncrementalAlterConfigsRequest

  *  RenewDelegationTokenRequest

  *  SaslAuthenticateRequest

  *  createDelegationTokenResponse

  *  describeDelegationTokenResponse

  *  SaslAuthenticateResponse


This issue affects Apache Kafka: from any version supported the
listed API above through v3.9.1, v4.0.0. We advise the Kafka
users to upgrade to v3.9.2, v4.0.1, or later to avoid this
vulnerability.

Credit:

Alyssa Huang <ah...@confluent.io> (finder)
Luke Chen <sh...@gmail.com> (finder)

References:

https://kafka.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-33558


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================