A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching /…/` regular-expression literals using the string unquoting rules, which strips every backslash escape. An allow rule such as `matching /orders\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\d` and `\w` lose their special meaning. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource that should have been denied.

Originally reported upstream in the open: https://github.com/kroxylicious/kroxylicious/issues/5236 (public since 2026-10-28). Draft advisory: GHSA-x5xx-3j9w-x63g. Formal CVE request: PSIRTSUPT-30443. Distinct from CVE-2026-118952 (ACL prefix-matching bypass in the same component).