Apache Kafka: authentication bypass via SASL/OAUTHBEARER

Apache Software Foundation Apache Kafka

Apache Kafka before 4.4.0 has an authentication bypass vulnerability via SASL/OAUTHBEARER. A Kafka broker does not enforce JWT issuer and audience validation by default.

Do this now

Upgrade Apache Kafka to 4.4.0 to close the SASL/OAUTHBEARER authentication bypass.

Fix it

Upgrade to Apache Kafka 4.4.0

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 18:19 UTC
Fixed in: 4.4.0
Identifiers: CVE-2026-110952
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Kafka: authentication bypass via SASL/OAUTHBEARER
Severity: unknown. Patch status: patched.
Affected: Apache Software Foundation Apache Kafka
Fixed in: 4.4.0
Ids: CVE-2026-110952

Apache Kafka before 4.4.0 has an authentication bypass vulnerability via SASL/OAUTHBEARER. A Kafka broker does not enforce JWT issuer and audience validation by default.

## Steps
1. Search the repo, its CI and infra config for Apache Software Foundation Apache Kafka. If present, report the version in use and whether it's affected.
2. Fix by release line: Apache Kafka: 4.4.0.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache Kafka | fixed | 4.4.0 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-110952") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/415
https://pwned.coffee/i/apache-kafka-authentication-bypass-via-sasl-oauthbearer-cve-2026-110952

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Apache Kafka before 4.4.0 4.4.0 CVE record (CNA) checked 28 Oct
Score: No CVSS published yet: severity unknown.
Last checked: 28 Oct 2026, 18:19 UTC

Product	Affected	Fixed in	Source
Apache Kafka	before 4.4.0	4.4.0	CVE record (CNA) checked 28 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

seclists.org: CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone coffee