Description (CNA)
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / StreamsHub Console for Apache Kafka® | affected 0.2.1 before 0.12.9; affected 0.13.0 before 0.14.1 |
| Red Hat / streams for Apache Kafka 2 | affected |
| Red Hat / streams for Apache Kafka 3 | affected |
CWE
CWE-470
References
- https://access.redhat.com/security/cve/CVE-2026-96740
- https://bugzilla.redhat.com/show_bug.cgi?id=2539427
- https://github.com/advisories/GHSA-3rpr-3qjq-fg52
- https://github.com/streamshub/console/commit/d45897e12
- https://github.com/streamshub/console/commit/ef13971
- https://github.com/streamshub/console/pull/2957
ADP enrichment
No English description supplied.
No references supplied.