CVE-2026-118952— Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules

Quick assessment

Affected

Red Hat streams for Apache Kafka 2

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Kroxylicious ACL 授权器中发现了一个缺陷。其前缀匹配逻辑可能将规则错误地应用于不同类型的主主体（principal），或者在前缀重叠时未能检查更宽泛的匹配规则。根据 ACL 配置的不同，这可能导致已认证的 Kafka 客户端访问本应被拒绝的资源（例如读取某个主题）。

CVSS 6.5 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Red Hat	streams for Apache Kafka 2	-	`cpe:/a:redhat:amq_streams:2`
Red Hat	streams for Apache Kafka 3	-	`cpe:/a:redhat:amq_streams:3`

II. Public POCs for CVE-2026-118952

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118952

请登录查看更多情报信息。

Other References for CVE-2026-118952 (3)

https://access.redhat.com/security/cve/CVE-2026-118952 vdb-entry x_refsource_REDHAT
https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc
https://bugzilla.redhat.com/show_bug.cgi?id=2563276 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-118952

Same Patch Batch · Red Hat · 2026-10-30 · 13 CVEs total

CVE-2026-103963	7.5 HIGH	Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows r
CVE-2026-115455	6.5 MEDIUM	Gcc: stack overflow in std::bitset on libstdc++
CVE-2026-91920	6.5 MEDIUM	Undertow: undertow: chunkreader message length permits chunk-size overflow
CVE-2026-114690	6.2 MEDIUM	Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
CVE-2026-114691	5.9 MEDIUM	Gcc: integer wrap in `std
CVE-2026-118593	5.9 MEDIUM	Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-460
CVE-2026-110133	5.8 MEDIUM	Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal int
CVE-2026-118959	5.4 MEDIUM	Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
CVE-2026-118947	4.3 MEDIUM	Keycloak-services: keycloak-services: authorization bypass via uma resource registration i
CVE-2026-115456	3.7 LOW	Gcc: out-of-bounds read in std::from_chars
CVE-2026-118475	3.6 LOW	Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp
CVE-2026-112922	3.3 LOW	Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of in

IV. Related Vulnerabilities

Same vendor: Red Hat

Same weakness: CWE-863