Skip to content
OpenAdvisories

Product · Red Hat

streams for Apache Kafka 2

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-118952

    Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules

    A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authentic…

    Red Hat streams for Apache Kafka 3 streams for Apache Kafka 2
  • Medium 6.5
    CVE-2026-96740

    Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

    A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR au…

    Red Hat streams for Apache Kafka 3 streams for Apache Kafka 2 StreamsHub Console for Apache Kafka®