{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-118952","cwes":["CWE-863"],"description":"A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.","epss":{"date":"2026-11-12","percentile":0.14033,"score":0.00231},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794510009243,"publishedAt":1793340254196,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-118952"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563276"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc"}],"remediation":[],"revision":"35c013f60b6912bd84065c6a3010ab8337b69af758cb499cd50d5820aa3d142a","sources":[{"modifiedAt":1794510009243,"name":"CNA: redhat","retrievedAt":1794510527282,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118952"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794510528157,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118952"}],"ssvc":{"assessedAt":1793389068997,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules","updatedAt":1794510528157}