CVE-2026-92778— CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes
Quick assessment
Affected
yahoo CMAK
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CMAK 3.0.0.6 及更早版本未能将“定时选举”功能的开关正确应用到 HTML 表单路由，导致攻击者可以绕过该功能门控。攻击者能够访问表单端点，从而启动或停止周期性选举调度器，进而扰乱所管理的 Kafka 集群的领导权（Leader）状态。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92778
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes
Source: CVE Program / CVE List V5
Vulnerability Description
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92778
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92778
请登录查看更多情报信息。
Other References for CVE-2026-92778 (4)
-
-
-
🔗 Unicorn! · GitHub technical-description
-
IV. Related Vulnerabilities
Same vendor: yahoo
-
CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing -
CVE-2026-57954
Elide 7.1.17 - Permission Bypass in Sort Expression Validati -
CVE-2026-34043
Serialize JavaScript has CPU Exhaustion Denial of Service vi -
CVE-2022-24827
SQL Injection in elide-datastore-aggregation -
CVE-2020-5289
Read permissions not enforced for client provided filter exp
Same weakness: CWE-693
-
CVE-2026-20331
Cisco Secure Adaptive Security Appliance Software, Secure Fi -
CVE-2026-77401
Zope AccessControl: Information disclosure through Python st -
CVE-2026-91949
FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass -
CVE-2026-57137
PraisonAI AgentLoop onToolCall approval runs after tool exec -
CVE-2026-47424
OpenAM Authenticated RCE via Groovy Sandbox Escape
V. Comments for CVE-2026-92778
No comments yet