CVE-2026-105312criticalCWE-269

CVE-2026-105312: falha crítica em Red Hat streams for Apache Kafka 2

Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar streams for Apache Kafka+ Monitorar StreamsHub Console for Apache Kafka®

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 0.3%
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Produtos afetados
Red Hat · streams for Apache Kafka 2Red Hat · streams for Apache Kafka 3Red Hat · StreamsHub Console for Apache Kafka®
CVEs relacionadas — Red Hat streams for Apache Kafka 2

No mesmo produto, das mais perigosas para as menos.

CVE-2026-96740MEDIUMStreamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providersEPSS 0.4%CVE-2026-105949HIGHCruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpointsEPSS 0.3%CVE-2026-105311HIGHConsole-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputyEPSS 0.3%CVE-2026-105941HIGHKroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultnameEPSS 0.2%CVE-2026-118952MEDIUMKroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rulesEPSS 0.2%