CVE-2026-33557
CVE-2026-33557: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityCritical9.1
Critical [CVE-2026-33557] Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
CVE-2026-33557Source published Source updated
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
- Affected products in this advisory
- Apache Kafka
- Source-reported affected versions
- Apache Kafka 4.1.0 through 4.1.1
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityHigh8.6
High [CVE-2026-33557] Authentication bypass via improper JWT validation
CVE-2026-33557Source published
Authentication bypass via improper JWT validation. Red Hat rates this important (CVSS 8.6). Weakness: CWE-303. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.
- Affected products in this advisory
- Red Hat build of Debezium 3
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.