Kroxylicious: SSRF in Azure Key Vault KMS provider leaks bearer token

Summary

The Azure Key Vault KMS provider of the Kroxylicious Kafka proxy uses the vaultName from wire-deserialized EDEK data without format validation. An attacker who can write records to a topic on the proxied cluster can trigger server-side request forgery and make the proxy send its Azure bearer token to an attacker-controlled host. The stolen token can be replayed against the real Key Vault, which undermines the record-encryption trust model. The flaw only applies where the Record Encryption filter is used with the Azure Key Vault KMS provider.

Affected

• Kroxylicious with the Record Encryption filter and the Azure Key Vault KMS provider
• Red Hat Streams for Apache Kafka 3 (package kroxylicious-kms-provider-azure-key-vault-kms, default: affected)
• Exact affected version range: Unknown. An unverified aggregator lists >=0.17.0, <=0.25.0.
• Other KMS providers (for example AWS KMS, HashiCorp Vault) and deployments without the Record Encryption filter are not affected, according to the vendor.

Fixed in

• Kroxylicious 0.25.1 (upstream fix, GHSA-5j25-p663-ww5r)
• Kroxylicious 0.24.x: backport merged, release version Unknown
• Red Hat Streams for Apache Kafka 3: fixed build Unknown

Workaround

• Restrict proxy pod egress with a Kubernetes NetworkPolicy to the legitimate Azure Key Vault endpoints on port 443 (Red Hat guidance)
• Alert on unwrap requests that target unexpected vault hostnames (Red Hat guidance)
• These measures limit the impact but do not fix the underlying defect. Apply the upstream fix.

Exploitation

• CISA SSVC: exploitation none, automatable no
• Not listed in CISA KEV (per a third-party tracker)
• No public proof of concept confirmed (per a third-party tracker, unverified)

Our recommendation

• Check whether Kroxylicious is deployed with the Record Encryption filter and the Azure Key Vault KMS provider. If not, no action is needed.
• Upgrade to Kroxylicious 0.25.1 or later, or to the fixed Red Hat Streams for Apache Kafka build once it is available. Check the Red Hat advisory for the fixed build.
• Until patched, restrict proxy egress to Azure Key Vault endpoints and monitor KMS calls to unexpected hosts.
• Review write access to Kafka topics, since exploitation requires producing crafted records.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Red Hat CVE record CVE-2026-105941 access.redhat.com
• Red Hat Bugzilla 2510876 bugzilla.redhat.com
• GitHub Security Advisory GHSA-5j25-p663-ww5r github.com
• Fix commit aa1b02a5 github.com
• Kroxylicious v0.25.1 release github.com
• Kroxylicious issue 5166 github.com
• Kroxylicious backport PR 5201 github.com
• Vulners CVE-2026-105941 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:41.