CVE-2026-96740 — Vulnerability intelligence

—

Published: 2026-09-28T18:17:26.880

CVSS

6.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Sources

• CVE-2026-96740
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory