Vulnerability details

CVE-2026-105312

Red Hat StreamsHub Console for Apache Kafka®Red Hat streams for Apache Kafka 3

Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

CVSS 3.1

9.9Critical

Official description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

CVSS scores

Score	Version	Source	Vector
9.9Critical	3.1	CVEProject cvelistV5 (CNA) (redhat)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
Red Hat	StreamsHub Console for Apache Kafka®	0.13.0 ≤ v < 0.14.2	CVEProject cvelistV5 (CNA)
Red Hat	StreamsHub Console for Apache Kafka®	0.2.0 ≤ v < 0.12.10	CVEProject cvelistV5 (CNA)
Red Hat	streams for Apache Kafka 3	All	CVEProject cvelistV5 (CNA)

References and advisories

https://access.redhat.com/security/cve/CVE-2026-105312 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2510863 issue-trackingx_refsource_REDHAT

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-20
Last updated: 2026-11-03
State: Published
Assigner (CNA): redhat
Kolun priority: 28 · Low

Exploit prediction (EPSS)

0.33%

Probability of exploitation in 30 days

27.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-269
Improper Privilege Management