MEDIUM 6.5 NVD
CVE-2026-118952
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader m
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
References
- https://access.redhat.com/security/cve/CVE-2026-118952
- https://bugzilla.redhat.com/show_bug.cgi?id=2563276
- https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.