News · via oss-security
CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 4.1.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 Description: A Kafka broker using…