CVE-2026-118952
Medium 6.5
Description
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Metrics
- CVSS 3.1
-
6.5 (MEDIUM)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% (percentile: 14) as of 1 November 2026
- CWE
- CWE-863