CVE-2026-105941 affects Red Hat Streams for Apache Kafka 3. The Kroxylicious Azure Key Vault KMS provider accepts an unvalidated vaultName, enabling server-side request forgery that exfiltrates the proxy Azure bearer token.
Red Hat rates it 8.1 high and ships the fix in Kroxylicious 0.25.1. No exploitation is reported.