CVE-2026-118952

MEDIUM

MEDIUM Priority: 0.00 BB Relevance: 63/100

Published: 2026-10-30 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: Low

UI: None

S: Unchanged

C: High

I: None

A: None

Description

A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.