CVE-2026-105949
8.8HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-287
Impact
Unauthenticated adjacent network attackers can reach all 15 administrative endpoints by manipulating URL path segments. This allows unauthorized actions such as triggering cluster rebalances without valid credentials.
Root cause
Cruise Control defines exact path specs in Jetty's security handler without wildcard fallbacks, while the routing servlet strips path prefixes using Path.of().getFileName(), bypassing authentication checks.
Affected systems
Cruise Control / AMQ Streams; specific version numbers are not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the patched Cruise Control/AMQ Streams release once available. As an immediate mitigation, enforce network policies or firewall rules to restrict port 9090 strictly to authorized operator pods.
$ kubectl get networkpolicies -A | grep -i cruise-controlAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.