{"id":"CVE-2026-105941","revision":"08ebf1d8b2fd40e38ab698dfb6b50812","records":[{"revision":"08ebf1d8b2fd40e38ab698dfb6b50812","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105941","aliases":[],"title":"Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname","description":"The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.","state":0,"publishedAt":"2026-10-20T12:59:00.134+00:00","modifiedAt":"2026-10-20T22:34:19.3+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kroxylicious-kms-provider-azure-key-vault-kms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"streams for Apache Kafka 3\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kroxylicious-kms-provider-azure-key-vault-kms\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:amq_streams:3\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://access.redhat.com/security/cve/CVE-2026-105941","https://bugzilla.redhat.com/show_bug.cgi?id=2510876","https://github.com/kroxylicious/kroxylicious/commit/aa1b02a5f8e5bb5003f88b3160a811019cd11139","https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-5j25-p663-ww5r"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105941","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105941","identifiers":["CVE-2026-105941"]},"retained":false,"historicalAffected":[]}],"coverage":[]}