Description
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
Published: 2026-10-20
Score: 8.1 High
EPSS: n/a
KEV: No
Impact: Exfiltration of Azure bearer token enabling impersonation of the broker and compromise of record-encryption trust
Action: Immediate Patch
AI Analysis

Impact

The Azure Key Vault KMS provider in Kroxylicious accepts untrusted vaultName values extracted from wire‑deserialized EDEK bytes without format validation. This omission allows an attacker to trigger a Server Side Request Forgery that causes the proxy to send the bearer token to an attacker‑controlled host. The token can then be replayed against the real Key Vault, breaking the encryption trust model and exposing stored data.

Affected Systems

The flaw affects Red Hat Streams for Apache Kafka version 3, which includes the Kroxylicious KMS provider. Any deployment of Streams for Apache Kafka 3 that has not applied a responsible fix is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.1 denotes high severity and the lack of an EPSS rating means the probability of exploitation is currently unknown, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a Server Side Request Forgery triggered by sending maliciously crafted EDEK bytes to the broker. Successful exploitation supplies the attacker with the Azure bearer token, allowing subsequent impersonation of the broker or direct access to the Key Vault.

Generated by OpenCVE AI on October 20, 2026 at 14:14 UTC.

Remediation

Vendor Workaround

1. Restrict outbound network access — use Kubernetes NetworkPolicy to limit proxy pod egress to only legitimate Azure Key Vault endpoints on port 443. 2. Monitor KMS call patterns — alert on unwrap requests targeting unexpected vault hostnames. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce strict allowlist regex validation on wire-deserialized vaultName in the Azure Key Vault KMS provider before constructing outbound HTTP endpoints: upgrade to kroxylicious-kms-provider-azure-key-vault-kms 0.25.1+ (or the fixed Kroxylicious Kms Provider Azure Key Vault Kms builds), which validate Key Vault name using validateKeyVaultName to reject names containing dots, URL fragments, invalid lengths, or malformed hyphens before constructing the Key Vault URL, closing all 2 injection vectors (crafted EDEK containing an arbitrary hostname in vaultName, vaultName URL fragment injection). Until patched, this is a concern on Kafka clusters using the Kroxylicious Record Encryption filter with Azure Key Vault KMS, so restrict proxy pod outbound network egress using Kubernetes NetworkPolicy strictly to legitimate Azure Key Vault endpoints on port 443 and alert on unwrap requests targeting unexpected vault hostnames. As a compensating measure, Deploy Falco or eBPF runtime security to detect anomalous outbound network connections initiated by the Kroxylicious proxy process to unexpected destinations. These controls limit blast radius and contain exploitation, but they do not fix the underlying unvalidated input SSRF defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)

OpenCVE Recommended Actions

  • Update Red Hat Streams for Apache Kafka 3 to a patched release that addresses the Azure Key Vault SSRF vulnerability.
  • Bind all topics to KEKs; remove PASSTHROUGH_UNENCRYPTED as an unresolved key policy and explicitly set kekSelector to match each topic.
  • Restrict outbound network access from the Kroxylicious proxy pod by applying a Kubernetes NetworkPolicy that allows egress only to the legitimate Azure Key Vault endpoint on port 443.
  • Enable monitoring of KMS unwrap requests and configure alerts for unexpected or suspicious vault hostnames to detect token exfiltration attempts.
  • Validate or sanitize the vaultName field in EDEK bytes before deserialization to prevent untrusted inputs from reaching the Azure Key Vault client.

Generated by OpenCVE AI on October 20, 2026 at 14:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
Title Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
First Time appeared Redhat
Redhat amq Streams
Weaknesses CWE-918
CPEs cpe:/a:redhat:amq_streams:3
Vendors & Products Redhat
Redhat amq Streams
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Redhat Amq Streams
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-20T22:34:19.300Z

Reserved: 2026-10-06T07:03:52.238Z

Link: CVE-2026-105941

cve-icon Vulnrichment

Updated: 2026-10-20T13:40:31.659Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T13:16:39.457

Modified: 2026-10-20T20:17:12.970

Link: CVE-2026-105941

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T11:00:00Z

Links: CVE-2026-105941 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T14:15:14Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)