All vulnerabilities
CVE-2026-96740GHSA-3rpr-3qjq-fg52

Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

Red Hat StreamsHub Console for Apache Kafka®Operating systems
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.12.9Also 0.14.1CVE List
Published28 Sep 2026Updated 5 Oct 2026CVE List

What fixes it

  • 0.12.9StreamsHub Console for Apache Kafka®CVE List
  • 0.14.1StreamsHub Console for Apache Kafka®CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Text from CVE List

Affected versions 2

  • StreamsHub Console for Apache Kafka®affected: 0.2.1 before 0.12.9CVE List
  • StreamsHub Console for Apache Kafka®affected: 0.13.0 before 0.14.1CVE List

References 6