Apache Kafka fixes 12 flaws, including a cluster access bypass

Daily CyberSecurity reports that Apache Kafka has disclosed fixes for 12 vulnerabilities across its broker and Connect components. The most serious is CVE-2026-110985, which, in unauthenticated SASL/OAUTHBEARER setups without a JWKS endpoint URL, allows an attacker to forge a login token and gain full access to the cluster. The article notes a related issue, CVE-2026-110952, that skips issuer and audience checks unless admins configure them.

Other disclosed flaws include CVE-2026-112375, which can let an authenticated user read broker files and environment variables, and CVE-2026-116593, which exposes hidden configuration values via a Connect validation endpoint. Collectively, the bugs cover authentication bypass, secret exposure and memory-exhaustion crashes, with five defects enabling memory allocation attacks and several others affecting broker or Connect components.

Patches are delivered in Kafka 4.2.2, 4.3.2 and 4.4.0. The report emphasises additional recommended mitigations beyond upgrading: set sasl.oauthbearer.jwks.endpoint[.]url on every OAUTHBEARER listener to fix JWT signature verification without a full upgrade, explicitly configure the expected issuer and audience values, and bound the maximum decompressed message size (max.decompressed.message[.]bytes). It also advises removing admin[.]listeners in Kafka Connect if patching is not yet possible.

The piece notes that, to date, no exploitation of these Kafka vulnerabilities has been confirmed. Affected versions vary by CVE, but most prior to 4.2.2 and 4.3.x before 4.3.2 are impacted, with guidance to move to a supported branch.