Skip to content
fr Sign in
9.9 Critical

CVE-2026-105312 A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…

Description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

Affected products and versions

Product Affected versions Fixed in
StreamsHub Console for Apache Kafka® 0.13 0.13.0 → < 0.14.2 0.14.2
StreamsHub Console for Apache Kafka® 0.2 0.2.0 → < 0.12.10 0.12.10
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of StreamsHub Console for Apache Kafka®

The 3 CVEs of StreamsHub Console for Apache Kafka® →
CVE-2026-105311 The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console… 7.7 High CVE-2026-96740 A flaw was found in the StreamsHub Console for Apache Kafka 6.5 Medium
Track this CVE