CVE-2026-105941
HighCVSS 8.1Summary
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
Risk Assessment
An attacker can steal the Azure token and access the real Key Vault, undermining the confidentiality and integrity of encrypted records. This may lead to data disclosure and bypass of encryption mechanisms.
Recommendation
Upgrade Kroxylicious to a version containing the vaultName validation fix. Until then, limit Azure token permissions and monitor for unusual Key Vault requests.
Other vulnerabilities in Kroxylicious
Original NVD description (English source)
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS