{"id":"CVE-2026-105941","kind":"vulnerability","aliases":["CVE-2026-105941"],"related":[],"title":"Kroxylicious: untrusted vault name leaks Azure bearer token via SSRF","description":"The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.","summary":"The Azure Key Vault KMS provider in Kroxylicious trusts a vault name taken from wire-deserialized encrypted data keys without validating its format. An attacker can make the proxy send its Azure bearer token to a host they control, then replay that token against the real Key Vault.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kroxylicious-kms-provider-azure-key-vault-kms","fixed":["0.25.1"],"affected":"0.25.0","ecosystem":"maven"}],"ecosystems":[],"tags":["azure-key-vault","kafka","kroxylicious","package","record-encryption","self-hosted","ssrf"],"not_affected_if":["aws-kms","hashicorp-vault","no-azure-kms-provider","no-record-encryption","non-azure-kms"],"how_to_check":"Look in the proxy config for the Record Encryption filter with kms: AzureKeyVaultKmsService. If it is there, check the proxy version: 0.25.0 is affected per the GHSA, 0.25.1 is fixed. Look in egress or DNS logs from the proxy for connections to hosts other than *.vault.azure.net. Producers with write access to a topic can plant a crafted EDEK.","fix":"Upgrade to Kroxylicious 0.25.1 (kroxylicious-kms-provider-azure-key-vault-kms 0.25.1). It validates the EDEK vaultName against ^[a-zA-Z0-9\\-]{3,24}$. If the Azure KMS provider ran on a vulnerable version, assume the proxy's Azure bearer token may have leaked. Review Key Vault access logs and the Entra sign-in logs for the proxy identity, and consider revoking sessions and rotating the proxy identity's credentials.","status":"open","published_at":"2026-10-20T13:16:39+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:06:32+00:00","updated_at":"2026-10-25T03:31:25+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-25T03:06:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Kroxylicious: untrusted vault name leaks Azure bearer token via SSRF","impact":"high","summary":"The Azure Key Vault KMS provider in Kroxylicious trusts a vault name taken from wire-deserialized encrypted data keys without validating its format. An attacker can make the proxy send its Azure bearer token to a host they control, then replay that token against the real Key Vault.","category":"package","nicknames":[],"who_cares":["kroxylicious","kafka","azure-key-vault","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Proxy Azure bearer token leaks; attacker replays it against Key Vault","analyst_note":"Get affected and fixed Kroxylicious versions and the Azure KMS config conditions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105941.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-azure-kms-provider"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000544,"input_tokens":3347,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Get affected and fixed Kroxylicious versions and the Azure KMS config conditions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105941.","search":"'-105941':13A,16A '-2026':12A,15A 'accept':96C 'attack':64B,122C 'attacker-control':121C 'azur':6A,26B,40B,71B,89C,116C 'azure':21A 'azure-key-vault':25B 'bearer':7A,72B,117C 'byte':105C 'control':78B,123C 'cve':11A,14A 'data':57B 'defeat':132C 'deseri':55B,103C 'edek':104C 'enabl':109C 'encrypt':34B,56B,137C 'entir':134C 'exfiltr':112C 'format':62B,107C 'host':37B,76B,124C 'kafka':29B 'key':22A,27B,41B,58B,86B,90C,130C 'kms':19A,24A,43B,92C 'kroxylici':1A,30B,46B,95C 'kroxylicious':18A 'kroxylicious-kms-provider-azure-key-vault-kms':17A 'leak':5A 'make':66B 'model':139C 'name':4A,50B 'packag':31B 'provid':44B,93C 'provider':20A 'proxi':68B,114C 'real':85B,129C 'record':33B,136C 'record-encrypt':32B,135C 'replay':80B,126C 'self':36B 'self-host':35B 'send':69B 'ssrf':10A,38B,110C 'taken':51B 'token':8A,73B,82B,118C,125C 'trust':47B,138C 'untrust':2A,98C 'valid':60B,108C 'vault':3A,23A,28B,42B,49B,87B,91C,131C 'vaultnam':99C 'via':9A 'wire':54B,102C 'wire-deseri':53B,101C 'without':59B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams running Kroxylicious with the Record Encryption filter and the Azure Key Vault KMS provider. An attacker only needs permission to produce a record to a topic the proxy decrypts. When a consumer fetches it, the proxy sends its Azure bearer token to an attacker-controlled host. Teams using no Record Encryption, or another KMS (AWS KMS, HashiCorp Vault, Thales), can skip this.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:31:25Z","by":"analyst","run_id":735},"how_to_check":{"at":"2026-10-25T03:31:25Z","by":"analyst","run_id":735},"who_affected":{"at":"2026-10-25T03:31:25Z","by":"analyst","run_id":735}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:16:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105941","severity":null,"published_at":"2026-10-20T13:16:39+00:00","modified_at":"2026-10-20T20:17:12+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105941:735","url":null,"severity":null,"published_at":"2026-10-25T03:31:25+00:00","modified_at":"2026-10-25T03:31:25+00:00","first_seen_at":"2026-10-25T03:31:25+00:00","fetched_at":"2026-10-25T03:31:25+00:00","note":"Read maintainer GHSA-5j25-p663-ww5r and 0.25.1 release post. GHSA lists affected 0.25.0 only, fixed 0.25.1; CVE record says all versions, so earlier releases unconfirmed. Not checked: public exploitation (none reported) or discussion on X/Bluesky. Red Hat's NetworkPolicy mitigation is AI-generated and unverified, so not recorded."}],"documents":[{"id":3209,"url":"https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-5j25-p663-ww5r","title":"GHSA-5j25-p663-ww5r Kroxylicious Azure KMS bearer token exfiltration","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3212,"url":"https://kroxylicious.io/blog/kroxylicious-proxy/releases/2026/10/20/release-0_25_1.html","title":"Kroxylicious release 0.25.1","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}