8.8
Élevée
CVE-2026-105949 Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a…
Description
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| streams for Apache Kafka 2 | Versions non publiées | |
| streams for Apache Kafka 3 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2510878 bugzilla.redhat.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de streams for Apache Kafka 2
Les 68 CVE de streams for Apache Kafka 2 →
CVE-2026-118952
A flaw was found in the Kroxylicious ACL authorizer
6.5
Moyenne
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…
9.9
Critique
CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…
7.7
Élevée
CVE-2026-96740
A flaw was found in the StreamsHub Console for Apache Kafka
6.5
Moyenne