{"id":"CVE-2026-118952","revision":"c6674f67ff674da092f355facc25d5aa","records":[{"revision":"c6674f67ff674da092f355facc25d5aa","observedAt":"2026-10-30T07:48:55.014+00:00","statement":{"source":"cve-program","id":"CVE-2026-118952","aliases":[],"title":"Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules","description":"A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.","state":0,"publishedAt":"2026-10-30T06:04:14.196+00:00","modifiedAt":"2026-10-30T06:04:14.196+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kroxylicious-authorizer-acl","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"streams for Apache Kafka 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kroxylicious-authorizer-acl\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:amq_streams:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"kroxylicious-authorizer-acl","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"streams for Apache Kafka 3\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"kroxylicious-authorizer-acl\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:amq_streams:3\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2026-118952","https://bugzilla.redhat.com/show_bug.cgi?id=2563276","https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118952","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-118952","identifiers":["CVE-2026-118952"]},"retained":false,"historicalAffected":[]}],"coverage":[]}