Kroxylicious CVE-2026-118952

Requires an authenticated Kafka client (PR:L) connecting to a Kroxylicious / Red Hat Streams for Apache Kafka deployment that uses the Kroxylicious ACL authorizer. The specific prerequisite is an ACL configuration in which prefix-based rules overlap or where principals of different types share a prefix - the flaw only manifests 'depending on the ACL configuration', so deployments whose ACLs lack overlapping/ambiguous prefixes are not exploitable. Limiting factors: valid authentication is mandatory (no anonymous/unauthenticated path), impact is confined to unauthorized access such as reading a denied topic (confidentiality), and the vulnerable condition depends on how the operator wrote the ACL rules rather than on a stock configuration.

Signals point to a real but moderate, conditional priority rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) shows network-reachable, low-complexity exploitation but requires an already-authenticated Kafka client (PR:L), with confidentiality-only impact (C:H) and no integrity or availability effect - consistent with CWE-863 Incorrect Authorization. The vuln.today decision label is 'this_month', aligning with moderate urgency, not act_now/emergency. No EPSS probability was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; a Kroxylicious GitHub Security Advisory (GHSA-qvv3-6w3q-hgqc) exists but it is a vendor advisory, not verified working exploit code, so POC availability is effectively unknown. The key limiting factor is that exploitability is configuration-dependent - the description states the bypass only occurs 'depending on the ACL configuration' where prefixes overlap - so many deployments may not be affected at all. Net: a credible authorization-bypass warranting patching on a normal cycle, not a high-CVSS-but-no-real-risk false alarm, yet not a drop-everything event given the authentication requirement and config dependency.

An attacker holding valid but low-privilege Kafka client credentials in a Kroxylicious/Streams for Apache Kafka deployment connects and requests a resource (for example, reads a topic) that their ACLs should deny. Because the authorizer's prefix-matching logic may apply a rule meant for a principal of a different type, or skip a broader denying rule when prefixes overlap, the request is incorrectly authorized and the client reads data it should not see. No public exploit identified at time of analysis; success depends entirely on the specific ACL rule set in use.