GCVE-110-NCSC-2026-312

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published August 19, 2026

Apache Kafka versions 4.1.0 and 4.1.1 contain a critical JWT validation vulnerability, affecting also Oracle Communications Unified Assurance and Oracle Enterprise Data Quality products, allowing unauthenticated attackers to gain unauthorized access and modify critical data.

Download JSON Open in Console

Weaknesses (CWE)

CWE-1285Improper Validation of Specified Index, Position, or Offset in InputCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-116Improper Encoding or Escaping of OutputCWE-502Deserialization of Untrusted Data

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Oracle Corporation	vers:unknown/*	—	—
Oracle	vers:unknown/*	—	—

Aliases

CVE-2026-33557 CVE-2026-33929 CVE-2026-34481 CVE-2026-41855 CVE-2026-70922

References

advisory

Browse GCVE Records

482 records in the GCVE database · Updated August 26, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON