# Kapacitor v1.8.6 vulnerabiltity

**URL:** <https://community.influxdata.com/t/kapacitor-v1-8-6-vulnerabiltity/58642>\
**Category:** Kapacitor\
**Tags:** kapacitor, security\
**Created:** [July 22, 2026, 8:16am UTC](https://community.influxdata.com/t/kapacitor-v1-8-6-vulnerabiltity/58642 "2026-07-22T08:16:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Quinn\_Nguyen](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/quinn_nguyen/32/20443_2.png) [@Quinn\_Nguyen](https://community.influxdata.com/u/Quinn_Nguyen)\
**Post date:** [July 22, 2026, 8:16am UTC](https://community.influxdata.com/t/kapacitor-v1-8-6-vulnerabiltity/58642/1 "2026-07-22T08:16:56Z")

</div>

Hello,  
We are testing kapacitor and found that we can authenticate as any user by using a JWT token signed with an empty `shared-secret`. This is an authentication bypass whenever `shared-secret` is left empty in the configuration.

It occurs in `Kapacitor/services/httpd/handler.go`, in the `BearerAuthentication` case (lines 613–630):

‘’’

case BearerAuthentication:

```auto
keyLookupFn := func(token \*jwt.Token) (interface{}, error) {

    // Check for expected signing method.

    if \_, ok := token.Method.(\*jwt.SigningMethodHMAC); !ok {

        return nil, fmt.Errorf("unexpected signing method: %v", token.Header\["alg"\])

    }

    return \[\]byte(h.sharedSecret), nil

}

// Parse and validate the token.

token, err := jwt.Parse(creds.Token, keyLookupFn)

if err != nil {

    HttpError(w, fmt.Sprintf("invalid token: %s", err.Error()), false, http.StatusUnauthorized)

    return

} else if !token.Valid {

    HttpError(w, "invalid token", false, http.StatusUnauthorized)

    return

}

```

‘’’

The code does not check that `h.sharedSecret` is non-empty, it is returned directly as the HMAC verification key. The JWT library in use (`github.com/golang-jwt/jwt/v4` v4.5.2) does not reject an empty key either: its `SigningMethodHMAC.Verify` validates only the key type (`[]byte`), never its length. So, when `shared-secret` is empty (the default in the generated config), an attacker can sign an HS256 token with the empty key and it passes `token.Valid`. The handler then trusts the `username` claim (line ~646) and resolves that user via `AuthService.User(username)`.

This is the same root cause as CVE-2019-20933 ( [Password bypass vulnerability · Issue #12927 · influxdata/influxdb · GitHub](https://github.com/influxdata/influxdb/issues/12927) ), in the same code lineage.

So, anyone who can reach the Kapacitor API can forge a Bearer token for any username, without knowing any secret, and bypass authentication. Even with an authentication backend enabled (`[auth] enabled = true`), this allows impersonating any user, including administrators, with full read and modify access to tasks, templates, and configuration.

Suggest remediation:

Reject JWT authentication when the shared secret is empty. In the Bearer branch, fail closed before parsing:

```auto
case BearerAuthentication:

```

` if h.sharedSecret == "" {`

` HttpError(w, "bearer authentication is not enabled", false, http.StatusUnauthorized)`

` return`

` }`

` // ... existing keyLookupFn / jwt.Parse ...`

This mirrors the InfluxDB fixes for CVE-2019-20933.

---

<div class="post-metadata">

**Author:** ![cbowden](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/cbowden/32/20322_2.png) [@cbowden](https://community.influxdata.com/u/cbowden)\
**Post date:** [July 23, 2026, 6:11pm UTC](https://community.influxdata.com/t/kapacitor-v1-8-6-vulnerabiltity/58642/2 "2026-07-23T18:11:03Z")

</div>

Hey there,

For issues like these, please contact us by email at [security@influxdata.com](mailto:security@influxdata.com), as that goes directly to our security team and notifies them immediately. The community forum isn’t really the best venue to have these conversations. I have already alerted them to this post and they’re looking into it, and they can give you a full reply if you reach out at that email address.

---

<div class="post-metadata">

**Author:** ![Quinn\_Nguyen](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/quinn_nguyen/32/20443_2.png) [@Quinn\_Nguyen](https://community.influxdata.com/u/Quinn_Nguyen)\
**Post date:** [July 24, 2026, 12:59am UTC](https://community.influxdata.com/t/kapacitor-v1-8-6-vulnerabiltity/58642/3 "2026-07-24T00:59:24Z")

</div>

Hello,  
I will send the info to the team at [security@influxdata.com](mailto:security@influxdata.com)  
Thank you for the reply.