Is CVE-2026-33557 actively exploited?

No active exploitation of CVE-2026-33557 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33557 be exploited remotely?

Yes. CVE-2026-33557 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33557?

CVE-2026-33557 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-33557

CRITICAL

CVE-2026-33557

CWE-1285Published: April 20, 2026· Updated: Apr 22, 2026

9.1

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.2th

Official Description

A possible security vulnerability has been identified in Apache Kafka.

By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it.

We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.

NVD Source

Technical Analysis

CVE-2026-33557 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.