Kroxylicious ACL Authorizer Flaw Affects Kafka Clients
CVE-2026-118952

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Streams For Apache Kafka 2
Streams For Apache Kafka 3
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118952?

A vulnerability exists in the Kroxylicious ACL authorizer where its prefix-matching logic can improperly apply access rules to different principal types or overlook broader matching rules in cases of overlapping prefixes. This misconfiguration can permit authenticated Kafka clients to gain access to restricted resources, such as reading a topic that should be off-limits, potentially compromising the security of sensitive data.

References

https://access.redhat.com/security/cve/CVE-2026-118952
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2563276
issue-trackingx_refsource_REDHAT
https://github.com/kroxylicious/kroxylicious/security/adv...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.