A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | streams for Apache Kafka 2 | unaffected | — |
| Red Hat | streams for Apache Kafka 3 | affected | — |
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 30 Oct 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied. | |
| Title | Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules | |
| First Time appeared |
Redhat
Redhat amq Streams |
|
| Weaknesses | CWE-863 | |
| CPEs | cpe:/a:redhat:amq_streams:2 cpe:/a:redhat:amq_streams:3 |
|
| Vendors & Products |
Redhat
Redhat amq Streams |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-10-30T06:04:14.196Z
Reserved: 2026-10-29T07:57:28.659Z
Link: CVE-2026-118952
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses