CVE-2026-105311
7.7HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-441
Impact
Authenticated cluster tenants can extract plaintext Kafka SASL credentials and TLS private keys from any namespace. An attacker only needs permission to create a Console custom resource in their own namespace.
Root cause
The StreamsHub Console operator blindly fetches KafkaUser Secrets across namespaces without enforcing same-namespace restrictions or access allowlists.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade StreamsHub Console operator once an upstream patch is released. Until then, use RBAC or an admission controller (like Kyverno or OPA Gatekeeper) to block users from creating or updating Console CRs with cross-namespace `spec.kafkaClusters[].credentials.kafkaUser.namespace` references.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.