{"id":"CVE-2026-118952","aliases":[],"cve":{"records":[{"id":"CVE-2026-118952","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T07:57:28.659Z","published":"2026-10-30T06:04:14.196Z","modified":"2026-10-30T06:04:14.196Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-10-30T06:04:14.196Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118952","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563276","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-863","description":"Incorrect Authorization","source":"redhat"}],"applicability":[],"prioritization":[]},"title":"Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.","score":6.5,"severity":"medium","published":"2026-10-30T06:04:14.196Z","modified":"2026-10-30T06:04:14.196Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"streams for Apache Kafka 2","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:amq_streams:2"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-118952"},{"vendor":"Red Hat","name":"streams for Apache Kafka 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:amq_streams:3"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-118952"}],"remediation":[],"references":["https://access.redhat.com/security/cve/CVE-2026-118952","https://bugzilla.redhat.com/show_bug.cgi?id=2563276","https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc"],"sources":[{"name":"CVE","id":"CVE-2026-118952","modified":"2026-10-30T06:04:14.196Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118952"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T06:30:52.907Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T02:55:33.139Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T06:35:33.791Z","attemptedAt":"2026-10-30T06:35:33.791Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T06:35:33.950Z","attemptedAt":"2026-10-30T06:35:33.950Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T06:35:33.141Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T06:35:33.271Z","attemptedAt":"2026-10-30T06:35:33.271Z"}],"evidence":[],"aiSummary":{"text":"A flaw in the Kroxylicious ACL authorizer's prefix-matching logic may allow an authenticated Kafka client to access a resource that should be denied. The issue affects Red Hat streams for Apache Kafka 3. The impact depends on the ACL configuration.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:32:01.034Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118952"}]}}