CVE-2026-105941

The Azure Key Vault KMS provider in Kroxylicious is vulnerable to a Server-Side Request Forgery (SSRF) due to a lack of format validation on the vaultName parameter received from wire-deserialized EDEK bytes. This flaw allows an attacker to exfiltrate the proxy's Azure bearer token to an attacker...

CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...