CVE-2026-105312
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
| CWE | CWE-269 |
| Vendor | red hat |
| Product | streamshub console for apache kafka® |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat streamshub console for apache kafka®
Be the first to know when new critical vulnerabilities affecting red hat streamshub console for apache kafka® are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
Red Hat / StreamsHub Console for Apache Kafka®
0.2.0 < 0.12.10 0.13.0 < 0.14.2
Red Hat / streams for Apache Kafka 2
All versions affected Red Hat / streams for Apache Kafka 3
All versions affected