Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-105311

Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat StreamsHub Console for Apache Kafka®

Default version status: unaffected

  • 0.2.0 to < 0.12.10affected
  • 0.13.0 to < 0.14.2affected

Red Hat streams for Apache Kafka 2

Default version status: affected

Red Hat streams for Apache Kafka 3

Default version status: affected

References