Skip to content
fr Sign in
7.7 High

CVE-2026-105311 The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…

Description

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

Affected products and versions

Product Affected versions Fixed in
StreamsHub Console for Apache Kafka® 0.13 0.13.0 → < 0.14.2 0.14.2
StreamsHub Console for Apache Kafka® 0.2 0.2.0 → < 0.12.10 0.12.10
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of StreamsHub Console for Apache Kafka®

The 3 CVEs of StreamsHub Console for Apache Kafka® →
CVE-2026-105312 A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an… 9.9 Critical CVE-2026-96740 A flaw was found in the StreamsHub Console for Apache Kafka 6.5 Medium
Track this CVE