CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not confi

CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

Reported by oss-security

Summary by Cyber Security News28 Oct 2026, 18:27 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/416

Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 4.1.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 Description: A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset (the default) and...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

A Hybrid Approach for Automated Security Pattern Recovery

PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures

Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures

CVE-2026-109518: RCE in apt(1) (DSA 6607-1)