Live › vulnerability › CVE-2026-118952
Kroxylicious, a Kafka proxy, has a flaw in its ACL authorizer where overlapping prefix rules may be applied to the wrong principal or skipped. An authenticated Kafka client may therefore access a resource such as a topic that the ACL configuration should deny.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 07:29 UTC. All times on this page are UTC.
Only deployments that run the Kroxylicious proxy with its ACL authorizer and prefix-based rules are exposed, and the attacker must already hold valid Kafka credentials. Teams not using Kroxylicious ACLs can skip it. The sources do not name affected versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
This page as .md · .json · in your agent: get_signal("CVE-2026-118952")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.