6.5
Medium
CVE-2026-118952 A flaw was found in the Kroxylicious ACL authorizer
Description
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2563276 bugzilla.redhat.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of streams for Apache Kafka 2
The 68 CVEs of streams for Apache Kafka 2 →
CVE-2026-105949
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a…
8.8
High
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…
9.9
Critical
CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…
7.7
High
CVE-2026-96740
A flaw was found in the StreamsHub Console for Apache Kafka
6.5
Medium