{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akroxyliciousazure_key_vault_kms_provider/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kroxylicious:azure_key_vault_kms_provider:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-105941"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Azure Key Vault KMS provider"],"_cs_severities":["high"],"_cs_tags":["ssrf","cloud-security","cloud"],"_cs_type":"advisory","_cs_vendors":["Kroxylicious"],"content_html":"\u003cp\u003eCVE-2026-105941 describes a critical security vulnerability within the Azure Key Vault KMS provider for Kroxylicious. The issue arises from a failure to perform adequate format validation on the \u003ccode\u003evaultName\u003c/code\u003e field when handling wire-deserialized Encrypted Data Encryption Key (EDEK) bytes. By providing a crafted \u003ccode\u003evaultName\u003c/code\u003e during the deserialization process, an unauthenticated attacker can force the application to perform a Server-Side Request Forgery (SSRF) request.\u003c/p\u003e\n\u003cp\u003eThis request is directed toward an attacker-controlled endpoint, effectively exfiltrating the Azure bearer token assigned to the proxy service. Once obtained, the attacker can replay this bearer token against the legitimate Azure Key Vault service. This compromise allows the attacker to bypass the record-encryption trust model, potentially leading to unauthorized access to sensitive data encrypted by the proxy. Given the reliance of the proxy on this token for cryptographic operations, the impact on the confidentiality of the processed data is significant.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for the exfiltration of sensitive Azure identity tokens used by the Kroxylicious proxy. Successful exploitation results in the compromise of the record-encryption trust model, potentially enabling unauthorized decryption of data handled by the proxy. This impacts any environment using the Kroxylicious Azure Key Vault KMS provider, potentially affecting all organizations managing Kafka record encryption via this service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor network traffic originating from the Kroxylicious service host for unauthorized egress connections to unknown or unexpected external hosts, particularly those attempting to communicate with Azure Identity endpoints.\u003c/li\u003e\n\u003cli\u003eIdentify and update all instances of the Kroxylicious Azure Key Vault KMS provider to the vendor-patched version immediately to remediate CVE-2026-105941.\u003c/li\u003e\n\u003cli\u003eReview Azure Identity logs for signs of anomalous token usage or logins originating from unexpected IP addresses that correlate with potential replayed bearer tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T14:17:17Z","date_published":"2026-10-20T14:17:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kroxylicious-ssrf/","summary":"The Kroxylicious Azure Key Vault KMS provider fails to validate vaultName parameters during EDEK wire-deserialization, enabling SSRF attacks to exfiltrate Azure bearer tokens.","title":"Kroxylicious Azure Key Vault KMS provider SSRF (CVE-2026-105941)","url":"https://feed.craftedsignal.io/briefs/2026-10-kroxylicious-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kroxylicious:azure_key_vault_kms_provider:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}