CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.
| CWE | CWE-352 |
| Vendor | yahoo |
| Product | cmak |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for yahoo cmak
Be the first to know when new high vulnerabilities affecting yahoo cmak are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
yahoo / CMAK
0 ≤ 3.0.0.6
References
github.com: https://github.com/yahoo/CMAK/issues/935 github.com: https://github.com/yahoo/CMAK github.com: https://github.com/yahoo/CMAK/blob/3.0.0.6/app/loader/KafkaManagerLoader.scala#L48 vulncheck.com: https://www.vulncheck.com/advisories/cmak-through-3.0.0.6-cross-site-request-forgery-via-missing-csrf-filter
Credits
George Chen