CVE-2026-105311
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.
| CWE | CWE-441 |
| Vendor | red hat |
| Product | streamshub console for apache kafka® |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat streamshub console for apache kafka®
Be the first to know when new high vulnerabilities affecting red hat streamshub console for apache kafka® are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Red Hat / StreamsHub Console for Apache Kafka®
0.2.0 < 0.12.10 0.13.0 < 0.14.2
Red Hat / streams for Apache Kafka 2
All versions affected Red Hat / streams for Apache Kafka 3
All versions affected