[ CVE-2026-118952 · Published 30 Oct 2026 ]
Vulnerability in Red Hat streams for Apache Kafka 2
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.