Kroxylicious
Monthly
Prefix-matching defects in the Kroxylicious ACL authorizer can let an authenticated Kafka client read topics that configured ACL rules are intended to deny when overlapping prefix rules or mixed principal types are present. The issue affects Red Hat Streams for Apache Kafka 2 and 3 deployments that use the Kroxylicious ACL authorizer and carries a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid Kafka client authentication plus an ACL configuration with overlapping or cross-type prefixes, so deployments without that layout are not exposed; no public exploit was identified at time of analysis.
A flaw was found in Kroxylicious. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Prefix-matching defects in the Kroxylicious ACL authorizer can let an authenticated Kafka client read topics that configured ACL rules are intended to deny when overlapping prefix rules or mixed principal types are present. The issue affects Red Hat Streams for Apache Kafka 2 and 3 deployments that use the Kroxylicious ACL authorizer and carries a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid Kafka client authentication plus an ACL configuration with overlapping or cross-type prefixes, so deployments without that layout are not exposed; no public exploit was identified at time of analysis.
A flaw was found in Kroxylicious. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.