Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105312— Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

Quick assessment

Affected
Red Hat StreamsHub Console for Apache Kafka®
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

拥有 Console 自定义资源（Custom Resources）创建权限的 Kubernetes 租户，可将 设置为任意容器镜像。该 Operator 会将此镜像部署到一个 Pod 中，该 Pod 所使用的 ServiceAccount 通过 ClusterRoleBinding 绑定到一个 ClusterRole，该 ClusterRole 授予了以下权限：对所有 Strimzi 自定义资源定义（CRD，包括 KafkaUsers）进行集群范围的 get/list/watch 操作；对 Kafka 和 Kaf

CVSS 9.9 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105312

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
Source: CVE Program / CVE List V5
Vulnerability Description
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat StreamsHub Console for Apache Kafka® 0.2.0 ~ 0.12.10 -
Red Hat streams for Apache Kafka 2 - cpe:/a:redhat:amq_streams:2
Red Hat streams for Apache Kafka 3 - cpe:/a:redhat:amq_streams:3

II. Public POCs for CVE-2026-105312

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105312

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-105312 (2)

Same Patch Batch · Red Hat · 2026-10-20 · 6 CVEs total

CVE-2026-105941 8.1 HIGH Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azur
CVE-2026-105311 7.7 HIGH Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfil
CVE-2026-112177 7.3 HIGH Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
CVE-2026-113496 5.0 MEDIUM Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
CVE-2026-113495 5.0 MEDIUM Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments

IV. Related Vulnerabilities

Same product: StreamsHub Console for Apache Kafka®
Same vendor: Red Hat
Same weakness: CWE-269

V. Comments for CVE-2026-105312

No comments yet

Leave a comment