CVE-2026-105941

{
  "etk_id": "ETK-2026-2194",
  "cve_id": "CVE-2026-105941",
  "display_id": "CVE-2026-105941",
  "ghsa_id": "GHSA-5j25-p663-ww5r",
  "euvd_id": "EUVD-2026-104983",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in Kroxylicious Azure Key Vault KMS provider",
  "summary": "The Kroxylicious Azure Key Vault KMS provider used in Red Hat streams for Apache Kafka 3 can make requests to an attacker-selected endpoint when processing untrusted EDEK metadata. An attacker who can cause such metadata to be processed may obtain the proxy's Azure credential and use it against Azure Key Vault services.",
  "mitigation": "Restrict the proxy's outbound network access to approved Azure Key Vault endpoints and limit the associated Azure identity to the minimum required permissions. Monitor for a vendor-provided update; no fixed version is recorded in the advisory.",
  "vendor": "Red Hat",
  "product": "streams for Apache Kafka 3",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "kroxylicious-kms-provider-azure-key-vault-kms",
      "purl": null
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 80.77263013333334,
  "t0_at": "2026-10-20T12:59:00.134000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T12:59:00.134000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T12:59:00.134000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105941"
    }
  }
}