All vulnerabilities
CVE-2026-105311

Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

Red Hat StreamsHub Console for Apache Kafka®Operating systems
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.12.10Also 0.14.2CVE List
Published20 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.12.10StreamsHub Console for Apache Kafka®CVE List
  • 0.14.2StreamsHub Console for Apache Kafka®CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

Text from CVE List

Affected versions 2

  • StreamsHub Console for Apache Kafka®affected: 0.2.0 before 0.12.10CVE List
  • StreamsHub Console for Apache Kafka®affected: 0.13.0 before 0.14.2CVE List

References 2