REDHAT-BUG-2572937: Medium severity vulnerability
A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes matching /…/ regular-expression literals using the string unquoting rules, which strips every backslash escape. An allow rule such as matching /orders\.v1/ is compiled as the regex orders.v1, which also matches unintended names such as ordersXv1, and character classes such as \d and \w lose their special meaning. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource that should have been denied.
Originally reported upstream in the open: https://github.com/kroxylicious/kroxylicious/issues/5236 (public since 2026-10-28). Draft advisory: GHSA-x5xx-3j9w-x63g. Formal CVE request: PSIRTSUPT-30443. Distinct from CVE-2026-118952 (ACL prefix-matching bypass in the same component).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Kafka client may be able to access a resource that an ACL rule was intended to deny. Exploitation depends on the deployed ACL configuration containing affected regular-expression matching rules.
What ACL rules are affected?
Rules using matching /…/ regular-expression literals are affected when they rely on backslash escapes. For example, matching /orders\.v1/ is compiled as orders.v1, allowing the dot to match unintended characters; escapes such as \d and \w also lose their regex meaning.
How can I tell whether my configuration is exposed?
Review ACL authorizer rules files for matching /…/ expressions containing backslashes. Check whether removal of those backslashes changes the expression into one that matches resource names that should be denied.