CVE-2026-105311: falha de alta gravidade em Red Hat streams for Apache Kafka 2
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.3%
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
Red Hat · streams for Apache Kafka 2Red Hat · streams for Apache Kafka 3Red Hat · StreamsHub Console for Apache Kafka®CVEs relacionadas — Red Hat streams for Apache Kafka 2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-96740MEDIUMStreamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providersEPSS 0.4%CVE-2026-105312CRITICALConsole-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalationEPSS 0.3%CVE-2026-105949HIGHCruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpointsEPSS 0.3%CVE-2026-105941HIGHKroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultnameEPSS 0.2%CVE-2026-118952MEDIUMKroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rulesEPSS 0.2%