CVE-2026-118952: Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Other sources
The reporter states that the issue was reproduced with kroxylicious-authorizer-acl 0.25.1 and that the authorizer has been included since 0.18.0. These version details are from the report and have not been independently confirmed as the affected range.
Upstream advisory: https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc Upstream issue: https://github.com/kroxylicious/kroxylicious/issues/5235
No fixed version or patch reference has been confirmed in the information currently available. Add the engineering-confirmed fix reference when available.
— Red Hat