All vulnerabilities
CVE-2026-105312

Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

Red Hat StreamsHub Console for Apache Kafka®Operating systems
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.12.10Also 0.14.2CVE List
Published20 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 0.12.10StreamsHub Console for Apache Kafka®CVE List
  • 0.14.2StreamsHub Console for Apache Kafka®CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

Text from CVE List

Affected versions 2

  • StreamsHub Console for Apache Kafka®affected: 0.2.0 before 0.12.10CVE List
  • StreamsHub Console for Apache Kafka®affected: 0.13.0 before 0.14.2CVE List

References 2