CVE-2026-105312

9.9Critical

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.9Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-269

Impact

Authenticated tenants with permission to create Console custom resources can escalate privileges to gain cluster-wide read and write control over all Strimzi Kafka resources. They do this by supplying an arbitrary container image that executes with the pod's overprivileged ClusterRole-bound ServiceAccount.

Root cause

The operator deploys user-defined container images into pods mounted with an overprivileged ClusterRoleBinding granting cluster-wide access to Strimzi CRDs.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Fix & remediation

Upgrade the Console operator once an updated package is released; as an immediate mitigation, revoke tenant RBAC permissions to create or update Console custom resources or enforce an admission policy blocking unauthorized container images in spec.containers.api.spec.image.

shell

$ kubectl get clusterrolebindings -o wide | grep -i strimzi

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-105312