TL;DR The Apache Kafka project disclosed 12 Apache Kafka vulnerabilities. The most serious, CVE-2026-110985, lets an unauthenticated attacker forge a login token and "gain full access to the cluster." Kafka rates six of the flaws Important, three Moderate and three Low. The bugs enable authentication bypass, secret theft and memory-exhaustion crashes. Fixes ship in Kafka 4.2.2, 4.3.2 and 4.4.0. However, two fixes also need new configuration settings to fully protect brokers.

TL;DR The Apache Kafka project disclosed 12 Apache Kafka vulnerabilities. The most serious, CVE-2026-110985, lets an unauthenticated attacker forge a login token and "gain full access to the cluster." Kafka rates six of the flaws Important, three Moderate and three Low. The bugs enable authentication bypass, secret theft and memory-exhaustion crashes. Fixes ship in Kafka 4.2.2, 4.3.2 and 4.4.0. However, two fixes also need new configuration settings to fully protect brokers.