8.1
High
CVE-2026-105941 The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes…
Description
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| streams for Apache Kafka 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2510876 bugzilla.redhat.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of streams for Apache Kafka 3
The 71 CVEs of streams for Apache Kafka 3 →
CVE-2026-118952
A flaw was found in the Kroxylicious ACL authorizer
6.5
Medium
CVE-2026-105949
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a…
8.8
High
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…
9.9
Critical
CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…
7.7
High