Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.

Etkilenen sürümler2 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-118952 Diğer
• github.com/…icious/security/advisories/GHSA-qvv3-6w3q-hgqc Diğer

Kayıt geçmişi

1. 30 Eki 2026 09:04Yayımlandı

İlgili açıklar

• 7,1 CVE-2026-119649Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
• 4,4 CVE-2026-119573Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret
• 5,1 CVE-2025-68392Incorrect authorization in Protectel
• 4,3 CVE-2026-119414Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create
• 2,5 CVE-2026-119377SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
• 4,3 CVE-2026-119147ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass