https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:28:51.237887+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09403 bdu:2026-09403 2026-10-03T04:28:51.392489+00:00 bdu:2026-09403 https://cve.radiocsirt.org/vuln/bit-kafka-2026-33557 BIT-kafka-2026-33557 — Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication 2026-10-03T04:28:51.392525+00:00

Affected: Bitnami: kafka

A possible security vulnerability has been identified in Apache Kafka.

By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.

We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0461 certfr-2026-avi-0461 — De multiples vulnérabilités ont été découvertes dans Apache Kafka. Elles permettent à un attaquant de provoquer une att… 2026-10-03T04:28:51.392564+00:00 certfr-2026-avi-0461 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad78101 CLEANSTART-2026-AD78101 — Security fix for CVE-2026-33557 applied in: apache-nifi 2.7.2-r7 2026-10-03T04:28:51.392581+00:00

Affected: CleanStart: apache-nifi

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-337334 EUVD-2026-337334 2026-10-03T04:28:51.392599+00:00 EUVD-2026-337334 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33557 fkie_cve-2026-33557 2026-10-03T04:28:51.392610+00:00

A possible security vulnerability has been identified in Apache Kafka.

By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.

We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

 https://cve.radiocsirt.org/vuln/ghsa-28jg-cgg7-j4wc GHSA-28jg-cgg7-j4wc — Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation 2026-10-03T04:28:51.392635+00:00

Affected: Maven: org.apache.kafka:kafka-clients

A security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.

Apache advises Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0254 NCSC-2026-0254 — Kwetsbaarheden verholpen in Oracle database producten 2026-10-03T04:28:51.392657+00:00 NCSC-2026-0254 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33557 UBUNTU-CVE-2026-33557 2026-10-03T04:28:51.392677+00:00

Affected: Ubuntu:Pro:18.04:LTS: kafka

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1166 WID-SEC-W-2026-1166 — Apache Kafka: Mehrere Schwachstellen 2026-10-03T04:28:51.392697+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.