28 matches found
CVE-2026-118952
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource...
EUVD-2026-113733
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource...
CVE-2026-118952 Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource...
CVE-2026-118952
A flaw in the Kroxylicious ACL authorizer prefix-matching logic may cause it to apply rules to principals of different types or skip broader matching rules when prefixes overlap. This vulnerability could allow an authenticated Kafka client to access unauthorized resources, such as reading a restr...
CVE-2026-118952
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource...
kroxylicious-pqc-filter
Kroxylicious PQC Record Encryption Filter A Kroxylicious filter plugin that provides transparent Post-Quantum Cryptography PQC record-level encryption for Apache Kafka using ML-KEM FIPS 203 key encapsulation with AES-256-GCM symmetric encryption. Kafka producers and consumers require zero code...
CVE-2026-105941
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
io.kroxylicious:kroxylicious-app (>=0.17.0, <=0.23.0), io.kroxylicious:kroxylicious-integration-tests (>=0.17.0, <=0.23.0) +1 more potentially affected by CVE-2026-105941 via io.kroxylicious:kroxylicious-kms-provider-azure-key-vault-kms (>=0.17.0, <=0.25.0)
io.kroxylicious:kroxylicious-kms-provider-azure-key-vault-kms MAVEN version =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.25.0 Source cves: CVE-2026-105941 Source advisory: MEND:CVE-2026-105941...
CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
CVE-2026-105941
The Azure Key Vault KMS provider in Kroxylicious is vulnerable to a Server-Side Request Forgery (SSRF) due to a lack of format validation on the vaultName parameter received from wire-deserialized EDEK bytes. This flaw allows an attacker to exfiltrate the proxy's Azure bearer token to an attacker...
CVE-2026-105941
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
EUVD-2026-104983
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
CVE-2026-105941
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
PT-2026-118363
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...
EUVD-2024-2592
Malicious code in bioql PyPI...
Improper Hostname Verification
io.kroxylicious, kroxylicious-runtime is vulnerable to Improper Hostname Verification. The vulnerability is due to Kroxylicious failing to properly verify the server's hostname during a TLS connection, which allows an attacker to intercept or manipulate communications...
io.kroxylicious:kroxylicious-app (>=0.4.0, <=0.7.0), io.kroxylicious:kroxylicious-integration-test-support (>=0.4.0, <=0.7.0) +1 more potentially affected by CVE-2024-8285 via io.kroxylicious:kroxylicious-runtime (>=0.4.0, <=0.7.0)
io.kroxylicious:kroxylicious-runtime MAVEN version =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.1 Source cves: CVE-2024-8285 Source advisory: GHSA-H83P-72JV-G7VP...
Missing hostname validation in Kroxylicious
A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...