Skip to content
OpenAdvisories

Product · Red Hat

streams for Apache Kafka 2

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-105949

    Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

    Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(…

    Red Hat streams for Apache Kafka 3 streams for Apache Kafka 2
  • High 7.7
    CVE-2026-105311

    Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

    The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets R…

    Red Hat streams for Apache Kafka 3 streams for Apache Kafka 2 StreamsHub Console for Apache Kafka®