CVE-2026-33557 — Apache Kafka JWT Validation Bypass

Key facts

CVE-2026-33557 (Apache) is a Critical (9.1) vulnerability: Apache Kafka JWT Validation Bypass. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Sigma) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-33557
Severity	Critical (9.1)
Vendor	Apache
Product	Apache Kafka
Detection / prevention	Snort, YARA, Nginx, Sigma
PoC	poc.py
Source	2026/CVE-2026-33557/

Details

CVE-2026-33557 (Apache) is a Critical (9.1) vulnerability: Apache Kafka JWT Validation Bypass. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx) — see Detection and prevention below. Source: NVD record.

Overview

Field	Value
CVE ID	CVE-2026-33557
CVSS	9.1 (CRITICAL)
Vendor	Apache
Product	Apache Kafka
Affected	4.1.0, 4.1.1
Fixed	4.1.2, 4.2.0+
Type	Authentication Bypass (CWE-287)
Vector	Network / No Auth Required

Description

The default sasl.oauthbearer.jwt.validator.class is set to DefaultJwtValidator, which accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the preferred_username set to any user, and the broker will accept it.

Usage

python3 poc.py --host kafka-broker.example.com --port 9092 --username admin

Remediation

1. Upgrade to Kafka 4.1.2 or 4.2.0+
2. Or configure the broker explicitly:

   sasl.oauthbearer.jwt.validator.class=org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator
   

References

• https://kafka.apache.org/cve-list
• https://lists.apache.org/thread/v57o00hm6yszdpdnvqx2ss4561yh953h

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-33557, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Detection-only PoC — poc.py

References: NVD — CVE-2026-33557 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigation

# CVE-2026-33557: Apache Kafka JWT Validation Bypass Detection
# Detects SASL/OAUTHBEARER authentication attempts with unsigned JWT tokens (alg:none)

# Alert on JWT tokens with "alg":"none" in Kafka SASL traffic
alert tcp any any -> any 9092 (msg:"CVE-2026-33557 Apache Kafka Forged JWT (alg:none)"; flow:to_server,established; content:"OAUTHBEARER"; content:"eyJ"; content:"|22|alg|22 3a 22|none|22|"; fast_pattern; sid:2026335571; rev:1; classtype:attempted-admin; reference:cve,2026-33557;)

# Alert on JWT tokens with untrusted issuer patterns
alert tcp any any -> any 9092 (msg:"CVE-2026-33557 Apache Kafka Suspicious JWT Issuer"; flow:to_server,established; content:"OAUTHBEARER"; content:"Bearer "; content:"eyJ"; pcre:"/preferred_username[\":\s]+(?:admin|root|kafka|superuser)/i"; sid:2026335572; rev:1; classtype:attempted-admin; reference:cve,2026-33557;)

# Alert on SASL/OAUTHBEARER handshake (informational - high volume)
# alert tcp any any -> any 9092 (msg:"CVE-2026-33557 Kafka OAUTHBEARER Handshake Detected"; flow:to_server,established; content:"OAUTHBEARER"; nocase; threshold:type limit,track by_src,count 1,seconds 60; sid:2026335573; rev:1; classtype:protocol-command-decode; reference:cve,2026-33557;)

:material-file-download: prevention/snort.rules

rule CVE_2026_33557_Kafka_JWT_Bypass {
    meta:
        description = "Detects Apache Kafka configuration vulnerable to CVE-2026-33557 JWT validation bypass"
        author = "SecProbe"
        date = "2026-04-21"
        cve = "CVE-2026-33557"
        severity = "CRITICAL"
        reference = "https://kafka.apache.org/cve-list"

    strings:
        // Vulnerable default validator class
        $vuln_class = "DefaultJwtValidator" ascii wide

        // Kafka config context
        $kafka_config1 = "sasl.oauthbearer" ascii wide
        $kafka_config2 = "jwt.validator.class" ascii wide
        $kafka_config3 = "server.properties" ascii wide

        // Fixed validator class (safe)
        $safe_class = "BrokerJwtValidator" ascii wide

    condition:
        ($vuln_class and any of ($kafka_config*)) and not $safe_class
}

rule CVE_2026_33557_Forged_JWT_Token {
    meta:
        description = "Detects forged JWT tokens with alg:none targeting Kafka OAUTHBEARER"
        author = "SecProbe"
        date = "2026-04-21"
        cve = "CVE-2026-33557"

    strings:
        $jwt_header_none = "eyJhbGciOiJub25lIi" ascii  // base64 of {"alg":"none"
        $oauthbearer = "OAUTHBEARER" ascii nocase
        $bearer = "Bearer " ascii

    condition:
        $jwt_header_none and ($oauthbearer or $bearer)
}

:material-file-download: prevention/yara.yar

# CVE-2026-33557 Prevention: Block unauthenticated Kafka SASL connections via Nginx stream proxy
# Apply if Nginx is used as a TCP proxy in front of Kafka brokers

stream {
    # Block connections that attempt OAUTHBEARER without proper TLS client certificate
    server {
        listen 9092;
        proxy_pass kafka_backend;

        # Require mutual TLS (mTLS) for Kafka connections
        ssl_certificate /etc/nginx/ssl/kafka-server.crt;
        ssl_certificate_key /etc/nginx/ssl/kafka-server.key;
        ssl_client_certificate /etc/nginx/ssl/ca.crt;
        ssl_verify_client on;

        # Only allow connections from known client certificates
        # This prevents forged JWT attacks by requiring valid mTLS first
    }

    upstream kafka_backend {
        server kafka-broker:9093;
    }
}

:material-file-download: prevention/nginx.conf

Frequently asked questions

What is CVE-2026-33557?

CVE-2026-33557 (Apache) is a Critical (9.1) vulnerability: Apache Kafka JWT Validation Bypass. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-33557?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-33557?

Apply the Nginx mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Related CVEs

Other entries for the same vendor or product:

• CVE-2024-25065 — Apache OFBiz SSRF (Critical (9.8))
• CVE-2024-32113 — Apache OFBiz Path (Critical (9.8))
• CVE-2024-36104 — Apache OFBiz Bypass (Critical (9.8))
• CVE-2024-38476 — Apache HTTP Server SSRF (Critical (9.8))
• CVE-2024-38856 — Apache OFBiz Pre-Auth RCE (Critical (9.8))
• CVE-2024-41107 — CloudStack Auth Bypass (Critical (9.8))
• CVE-2024-45195 — Apache OFBiz Unauth RCE (Critical (9.8))
• CVE-2024-45216 — Solr Auth Bypass (Critical (9.8))

---

For authorized security testing and research only. See the full source and NVD record.