Bug 2563276 (CVE-2026-118952)

Summary:	CVE-2026-118952 kroxylicious-authorizer-acl: Kroxylicious: ACL prefix matching can bypass authorization rules
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	chfoley, jturenov, swoodman
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 07:22:08 UTC

The reporter states that the issue was reproduced with kroxylicious-authorizer-acl 0.25.1 and that the authorizer has been included since 0.18.0. These version details are from the report and have not been independently confirmed as the affected range.

Upstream advisory: https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc
Upstream issue: https://github.com/kroxylicious/kroxylicious/issues/5235

No fixed version or patch reference has been confirmed in the information currently available. Add the engineering-confirmed fix reference when available.