CVE-2026-118952: Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-30 · updated 2026-10-30
Weakness: CWE-863

Description

A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.

Affected products

Red Hat streams for Apache Kafka 3: all versions

References

https://access.redhat.com/security/cve/CVE-2026-118952
https://bugzilla.redhat.com/show_bug.cgi?id=2563276
https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc

Get alerted when CVE-2026-118952 or the next vulnerability affects your stack