CVE-2026-110952

Range per package from the CVE record, for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kafka</name>
	<range><lt>4.4.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A Kafka broker that authenticates clients with SASL/OAUTHBEARER using
	  the bundled JWKS-backed validator always verifies the JWT signature,
	  but two further checks are only performed when explicitly configured:</p>
	<p>- The issuer (iss) claim is verified only when
	  sasl.oauthbearer.expected.issuer is set. When it is unset, a
	  validly-signed token carrying the expected audience is accepted
	  regardless of which issuer minted it. - An audience (aud) claim is
	  required only when sasl.oauthbearer.expected.audience is set. When it
	  is unset, a validly-signed token that omits the aud claim is accepted.
	  (A token that carries an aud claim is still rejected when no expected
	  audience is configured.)</p>
	<p>Both options default to unset and have been documented as optional
	  (Importance LOW) since KIP-768 (3.1.0).</p>
	<p>Impact: The exposure is realizable mainly in deployments whose JWKS
	  endpoint serves signing keys for more than one issuer (a multi-tenant
	  identity provider, an aggregated/shared JWKS, or shared signing keys):
	  a token minted for a different issuer, or a token lacking an audience,
	  may be accepted to authenticate — potentially as a higher-privileged
	  principal. In a single-issuer deployment where the provider controls
	  the iss claim and issues audience-scoped tokens, exposure is limited.
	  The signature trust anchor remains enforced in all cases. This is
	  distinct from CVE-2026-33557 (acceptance of unsigned/unvalidated
	  tokens); here the signature is validated and only the issuer/audience
	  checks are not enforced by default.</p>
	<p>Mitigation (all affected versions, no upgrade required): Set both
	  sasl.oauthbearer.expected.issuer (to your provider's exact iss value)
	  and sasl.oauthbearer.expected.audience (to the audience(s) your
	  brokers expect), per listener. Brokers that set these perform
	  exact-match issuer/audience checks and are not affected. Both have
	  been available since 3.1.0.</p>
	<p>Resolution: - From Apache Kafka 4.4.0: a broker configured with a JWKS
	  endpoint fails to start unless both sasl.oauthbearer.expected.issuer
	  and sasl.oauthbearer.expected.audience are set (secure by default).
	  Deployments that intentionally do not restrict the issuer and/or
	  audience may opt out per axis with
	  sasl.oauthbearer.allow.unverified.issuer=true and/or
	  sasl.oauthbearer.allow.unverified.audience=true.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-110952</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-110952</url>
    </references>
    <dates>
      <discovery>2026-10-28</discovery>
      <entry>2026-10-28</entry>
    </dates>
  </vuln>