Medium WID-SEC-2026-1166 2 CVEs

Apache Kafka: Mehrere Schwachstellen

Published Apr 16, 2026 · Updated Aug 13, 2026 · Revision 3 · de-DE

Vendor: Apache Vendor: IBM Product: Kafka Product: Storage Scale Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

Product

Apache Kafka ist eine verteilte Streaming-Plattform mit einer Publish-Subcribe-Architektur (Pub-Sub).

Vulnerabilities 2

Critical 9.1

CVE-2026-33557

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without valida…

Apache Software Foundation Apache Kafka apache-nifi debezium-3.5-connector-jdbc Ubuntu Wolfi Maven

Apr 20, 2026
Medium 5.3

CVE-2026-33558

Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is…

Apache Software Foundation Apache Kafka Apache Kafka Clients druid Ubuntu Wolfi Maven

Apr 20, 2026

Revision history

2026-08-13 #3
Neue Updates von IBM aufgenommen
2026-04-20 #2
Referenz(en) aufgenommen: EUVD-2026-23846, EUVD-2026-23849
2026-04-16 #1
Initiale Fassung

References

Apache Kafka Mailing List vom 2026-04-16
https://lists.apache.org/list.html?users%40kafka_apache_org
OSS Security Mailing List vom 2026-04-16
https://seclists.org/oss-sec/2026/q2/156
OSS Security Mailing List vom 2026-04-16
https://seclists.org/oss-sec/2026/q2/157
IBM Security Bulletin 7283637 vom 2026-08-13
https://www.ibm.com/support/pages/node/7283637