CVE-2026-105941
CVE-2026-105941 · Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
CVSS 8.1 · High · EPSS 0.2%
- Published
- Updated
Affected products and versions
streams for apache kafka 3
No fix published
Original sources
- https://access.redhat.com/security/cve/CVE-2026-105941
- https://bugzilla.redhat.com/show_bug.cgi?id=2510876
- https://github.com/kroxylicious/kroxylicious/commit/aa1b02a5f8e5bb5003f88b3160a811019cd11139
- https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-5j25-p663-ww5r
- https://nvd.nist.gov/vuln/detail/CVE-2026-105941