CVE-2026-33557 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-33557 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-33557 is an authentication-related vulnerability in Apache Kafka affecting the broker's SASL OAuthBearer JWT validation mechanism, specifically tied to the default configuration of the sasl.oauthbearer.jwt.validator.class broker property.

Technical Detail

The flaw originates in how Apache Kafka brokers handle JWT validation when the sasl.oauthbearer.jwt.validator.class property is left at its default value, which may permit insufficient or bypassable token validation logic. An attacker who can present a crafted or malformed JWT token to a Kafka broker configured with the default validator may be able to authenticate without valid credentials, constituting an authentication bypass. Depending on the broker's authorization configuration, successful exploitation could allow unauthorized access to Kafka topics, consumer groups, or administrative operations, with potential for data exfiltration or disruption of message pipeline integrity.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as unrealized, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Organizations should not treat the absence of a known exploit as a reason to delay remediation, given the critical CVSS score of 9.1 and the exposure surface of internet-facing or internally networked Kafka brokers.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability. Given that Apache Kafka is widely deployed in financial services, telecommunications, and large-scale data infrastructure environments, those sectors carry elevated inherent risk if exploitation activity emerges.

What To Do

Administrators should review and update the sasl.oauthbearer.jwt.validator.class broker property to use a hardened or explicitly configured JWT validator class rather than relying on the default. Apply any patches or updated releases issued by the Apache Kafka project addressing this CVE as a priority, treating this as a critical-severity item given the CVSS 9.1 rating. Where immediate patching is not feasible, restrict broker network exposure using firewall rules or Kafka ACLs, enforce strict network segmentation around Kafka clusters, and audit authentication logs for anomalous SASL OAuthBearer authentication attempts. Monitor the Apache Kafka security advisories page and the CISA KEV catalog for updates on exploitation activity.