{"id":"CVE-2026-105941","summary":"Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname","details":"The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.","aliases":["GHSA-5j25-p663-ww5r"],"modified":"2026-10-21T10:58:21.965584440Z","published":"2026-10-20T12:59:00.134Z","database_specific":{"cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105941.json","cna_assigner":"redhat"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-105941"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510876"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105941.json"},{"type":"FIX","url":"https://github.com/kroxylicious/kroxylicious/commit/aa1b02a5f8e5bb5003f88b3160a811019cd11139"},{"type":"ADVISORY","url":"https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-5j25-p663-ww5r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105941"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kroxylicious/kroxylicious","events":[{"introduced":"0"},{"fixed":"aa1b02a5f8e5bb5003f88b3160a811019cd11139"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"aa1b02a5f8e5bb5003f88b3160a811019cd11139"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["initial-commit"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105941.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/kroxylicious/kroxylicious/commit/aa1b02a5f8e5bb5003f88b3160a811019cd11139","target":{"file":"kroxylicious-kms-providers/kroxylicious-kms-provider-azure-key-vault-kms/src/test/java/io/kroxylicious/kms/provider/azure/config/AzureKeyVaultConfigTest.java"},"deprecated":false,"digest":{"line_hashes":["111151735260769047299129435085293954542","295641767303179161933404989774879523888","213777772361212323851615871688994988829"],"threshold":0.9},"id":"CVE-2026-105941-07963779","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/kroxylicious/kroxylicious/commit/aa1b02a5f8e5bb5003f88b3160a811019cd11139","target":{"file":"kroxylicious-kms-providers/kroxylicious-kms-provider-azure-key-vault-kms/src/main/java/io/kroxylicious/kms/provider/azure/config/AzureKeyVaultConfig.java"},"deprecated":false,"digest":{"line_hashes":["65988379971564870989293456501911244126","210558665891633138953681931190836062499","327004180463072810811460668231362098893","281513666056027948206668944435109084802"],"threshold":0.9},"id":"CVE-2026-105941-301b0938"},{"signature_version":"v1","source":"https://github.com/kroxylicious/kroxylicious/commit/aa1b02a5f8e5bb5003f88b3160a811019cd11139","target":{"file":"kroxylicious-kms-providers/kroxylicious-kms-provider-azure-key-vault-kms/src/main/java/io/kroxylicious/kms/provider/azure/config/AzureKeyVaultConfig.java","function":"keyVaultUrl"},"deprecated":false,"digest":{"function_hash":"26629709227641726852891557288987990022","length":178},"id":"CVE-2026-105941-e18f1578","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-21T10:58:21Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}