Apache Kafka patches JWT bypass, secret reads, and pre-auth memory DoS

Apache Kafka published four security fixes this week that range from full-cluster takeover via forged OAuth JWTs to unauthorized reads of broker host secrets and a pre-authentication denial of service. Operators running recent 4.x lines, and in some cases much older releases, should treat the batch as a single upgrade push rather than isolated patches.

The most severe item is CVE-2026-110985 (important). Brokers using SASL/OAUTHBEARER with the default JWT validator silently skip signature, algorithm, and issuer checks when the JWKS endpoint URL is unset and no custom verification key resolver is supplied. In that state the broker accepts any structurally valid token, including alg none, so an unauthenticated attacker who can reach the listener can assert any principal, including superusers, and take full control of the cluster. Only deployments that enable OAUTHBEARER without a JWKS URL (or equivalent verifier) are exposed; setting the URL restores verification. Fixed builds refuse to start in the insecure fallback instead of running quietly. The issue is a residual of an earlier OAuth fix that only covered the JWKS-configured path. Affected lines include 4.1.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0, with the fail-closed behavior in 4.2.2, 4.3.1, and 4.4.0. Mitigation without upgrading is to set the JWKS endpoint or a signature-verifying validator class.

CVE-2026-112375 (important) lets an authenticated principal with no authorization grants, not even ALTER_CONFIGS, coax a broker into reading arbitrary files or environment variables on the host and returning their contents. IncrementalAlterConfigs and AlterConfigs against a broker resource hit configuration validation before authorization, and variable resolution could instantiate providers outside the allowlist introduced for an earlier config-provider flaw. Type-validation errors then leak the resolved values, exposing credentials, keystores, and other secrets readable by the broker process. Clusters without an authorizer are effectively already wide open on configs. Fixes in 4.2.2, 4.3.2, and 4.4.0 authorize the change first and re-enforce the provider allowlist. Least-privilege OS accounts remain useful defense in depth. Affected spans reach back to 3.2.0.

CVE-2026-111115 (important) is a pre-auth heap exhaustion bug in flexible protocol parsing. Generated readers trusted a sender-declared tagged-field count bounded only by the outer frame size, so a modest request could demand tens of millions of small tagged-field objects, including on flexible headers parsed for APIs such as ApiVersions before authentication, ACLs, or quotas. That can OOM the broker or stall it under GC. Fixed readers bounds-check the count against remaining buffer bytes and a hard cap before allocating. Until upgrade, tightening socket.request.max.bytes and restricting listener reach reduce but do not eliminate risk. Affected versions run from 2.4.0 through current unfixed 4.x point releases.

CVE-2026-116593 (moderate) affects Kafka Connect: anyone who can hit the connector config validate REST endpoint can force configuration providers to resolve and return sensitive values in plaintext. Upgrades to 4.2.2, 4.3.2, or 4.4.0 close that path.

Across the board, Apache recommends 4.2.2, 4.3.2, or 4.4.0 (and 4.3.1 where it addresses the JWT case). Prioritize OAuth listeners without JWKS, Connect validate exposure, and internet-facing brokers for the memory amplification issue.