CVE-2026-128424

Description

A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching /…/` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\d` and `\w` lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 5.3CVSS 3.1, Mediumfrom the CNA (redhat)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

What to do

• Until a fixed release is available, write regex escapes with doubled backslashes (for example `/orders\\.v1/`), audit existing `matching` rules for unintended matches, and prefer exact or `like` predicates where regex matching is not required.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 28 Oct 2026 Made public.
2. 10 Nov 2026 Reported to Red Hat.
3. 13 Nov 2026 Published

Weakness

• CWE-863

References

• access.redhat.comvdb-entryx_refsource_REDHAT
• RHBZ#2572937issue-trackingx_refsource_REDHAT
• github.com
• github.com