CVE-2026-105312 — Vulnerability intelligence

Red Hat — StreamsHub Console for Apache Kafka®, streams for Apache Kafka 2, streams for Apache Kafka 3

Published: 2026-10-20T11:30:20.850Z

CVSS

9.9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

Sources

• CVE-2026-105312
• Original advisory
• Original advisory
• CVE-2026-105312