CVE-2026-118952
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Risk Assessment
Unauthorized access to Kafka resources may occur, violating access control policy and potentially exposing data.
Recommendation
Update Kroxylicious to a version containing the fix and review ACL configuration for overlapping prefixes.
Other vulnerabilities in Kroxylicious
Original NVD description (English source)
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS