Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Red Hat Streams for Apache Kafka console lets tenant run any container and gain cluster-wide access

CVE-2026-105312 · published 2 days ago
Summary

A tenant who can create console resources can tell the console to run any container image. That container runs with a service account that has broad permissions across the whole cluster, letting the tenant read and change Kafka configurations for other users. Restrict the create permission on console resources and limit the service account’s privileges, or upgrade to a version where this is fixed.

What to do
  • Update red hat streamshub console for apache kafka® to version 0.12.10 or later.
Affected software
VendorProductAffected versions
red hat streamshub console for apache kafka® < 0.12.10
red hat streams for apache kafka 2 All versions
red hat streams for apache kafka 3 All versions
Original advisory text
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published20 Oct 2026
Updated22 Oct 2026
First seen20 Oct 2026
Sources
CVE-2026-105312 · NVD
CVE-2026-105312 · MITRE
Track software like this
Free during beta