6.5
Moyenne
CVE-2026-118952 A flaw was found in the Kroxylicious ACL authorizer
Description
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| streams for Apache Kafka 2 | Versions non publiées | |
| streams for Apache Kafka 3 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2563276 bugzilla.redhat.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de streams for Apache Kafka 2
Les 68 CVE de streams for Apache Kafka 2 →
CVE-2026-105949
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a…
8.8
Élevée
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…
9.9
Critique
CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…
7.7
Élevée
CVE-2026-96740
A flaw was found in the StreamsHub Console for Apache Kafka
6.5
Moyenne