8.8
High
CVE-2026-105949 Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a…
Description
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2510878 bugzilla.redhat.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of streams for Apache Kafka 2
The 68 CVEs of streams for Apache Kafka 2 →
CVE-2026-118952
A flaw was found in the Kroxylicious ACL authorizer
6.5
Medium
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…
9.9
Critical
CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…
7.7
High
CVE-2026-96740
A flaw was found in the StreamsHub Console for Apache Kafka
6.5
Medium