kroxylicious-kms-provider-azure-key-vault-kms vulnerabilities

CVEs whose affected-version data names the kroxylicious-kms-provider-azure-key-vault-kms package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-105941High· 8.1

today

Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. To…

▾ TwilightRed Hat · kroxylicious-kms-provider-azure-key-vault-kmsvia CVEORG