SZB-b212fab312
EUVD-2026-113733 reports prefix-matching flaw in Kroxylicious ACL authorizer
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Kroxylicious
- Product
- ACL authorizer
- First seen
Summary
The EUVD (ENISA) entry, which gives a CVSS v3.1 score of 6.5/10, says a flaw in the Kroxylicious ACL authorizer's prefix-matching logic may apply rules to a principal of a different type or skip a broader matching rule. According to the entry, depending on the ACL configuration, an authenticated Kafka client may be able to access a restricted resource.
If you use Kroxylicious
Update Kroxylicious to a release that includes the fix
Review ACL rules that use overlapping prefixes
Restrict Kafka client access to the minimum resources needed
What the sources say 1
· Mastodon: “A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap.” Source