Aller au contenu
en Se connecter
9.9 Critique

CVE-2026-105312 A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…

Description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

Produits et versions touchés

Produit Versions touchées Corrigé en
StreamsHub Console for Apache Kafka® 0.13 0.13.0 → < 0.14.2 0.14.2
StreamsHub Console for Apache Kafka® 0.2 0.2.0 → < 0.12.10 0.12.10
streams for Apache Kafka 2 Versions non publiées
streams for Apache Kafka 3 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de StreamsHub Console for Apache Kafka®

Les 3 CVE de StreamsHub Console for Apache Kafka® →
CVE-2026-105311 The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console… 7.7 Élevée CVE-2026-96740 A flaw was found in the StreamsHub Console for Apache Kafka 6.5 Moyenne
Suivre cette CVE