6.5
Moyenne
CVE-2026-96740 A flaw was found in the StreamsHub Console for Apache Kafka
Description
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| streams for Apache Kafka 2 | Versions non publiées | |
| streams for Apache Kafka 3 | Versions non publiées | |
| StreamsHub Console for Apache Kafka® 0.13 | 0.13.0 → < 0.14.1 | 0.14.1 |
| StreamsHub Console for Apache Kafka® 0.2 | 0.2.1 → < 0.12.9 | 0.12.9 |
Références
- access.redhat.com access.redhat.com
- RHBZ#2539427 bugzilla.redhat.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de streams for Apache Kafka 2
Les 68 CVE de streams for Apache Kafka 2 →
CVE-2026-118952
A flaw was found in the Kroxylicious ACL authorizer
6.5
Moyenne
CVE-2026-105949
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a…
8.8
Élevée
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…
9.9
Critique
CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…
7.7
Élevée