CVE-2026-128424 · Infrastructure
NO FIX YET
Kroxylicious, a Kafka proxy, drops backslash escapes from regex literals in its ACL rules file. An allow rule such as matching /orders\.v1/ then also matches names like ordersXv1, so an authenticated Kafka client can reach topics it should be denied.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Kroxylicious with an ACL authorizer whose rules file uses regex literals with backslash escapes (for example \d, \w or .) in matching /.../ allow rules. Clusters that use no ACL rules with regex literals, or that do not use the ACL authorizer, are not described as exposed by the sources. Exploitation requires an authenticated Kafka client.
Not affected if auth-required, no-regex-acl-rules
Who cares acl, kafka, kroxylicious
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes matching /…/ regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as matching /orders\.v1/ is compiled as the regex orders.v1, which also matches unintended names such as ordersXv1, and character classes such as \d and \w lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.