CVE-2026-105312 is a critical (CVSS 9.9) privilege-management flaw in the StreamsHub Console for Apache Kafka operator. Any tenant who can create Console custom resources can run their own container image. That image gets cluster-wide read access to all Strimzi custom resources, including KafkaUsers. It can also patch Kafka and KafkaRebalance resources.
What Is It
The flaw is in how the Console operator handles container images set by users. A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to any container image. The operator then deploys that image into a pod whose ServiceAccount is bound, through a ClusterRoleBinding, to a ClusterRole that grants:
- cluster-wide
get/list/watchon all Strimzi CRDs, including KafkaUsers patchon Kafkas and KafkaRebalancescluster-monitoring-view
The attacker's code reads the projected ServiceAccount token. It then uses that token to read Strimzi resources across tenants and to patch other tenants' Kafka and KafkaRebalance resources. The weakness is CWE-269 (Improper Privilege Management).
Why It Matters
Red Hat scores this CVSS 3.1 9.9 (Critical), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. It is reachable over the network, takes little effort to exploit, needs only low privileges and needs no user interaction. The scope is Changed: one tenant's foothold reaches beyond their own boundary into Kafka resources that belong to other tenants. In multi-tenant clusters, a limited permission to create Console resources becomes cluster-wide read access to Strimzi resources, including KafkaUsers, plus the ability to patch other tenants' Kafka clusters and KafkaRebalances.
The supplied CISA KEV entry is empty, so KEV does not confirm active exploitation at this time. NVD lists the record as "Received" (published 2026-10-20).
What's Vulnerable
- StreamsHub Console for Apache Kafka (
console, github.com/streamshub/console): - 0.2.0 up to but not including 0.12.10
- 0.13.0 up to but not including 0.14.2
- Red Hat streams for Apache Kafka 2 (
console-operator,cpe:/a:redhat:amq_streams:2): listed as affected - Red Hat streams for Apache Kafka 3 (
console-operator,cpe:/a:redhat:amq_streams:3): listed as affected
Patch Status
The supplied data contains no explicit fix announcement. For upstream StreamsHub Console, the affected ranges end before 0.12.10 and 0.14.2, so those versions fall outside the listed affected ranges. For the Red Hat streams for Apache Kafka 2 and 3 console-operator packages, the data lists no fixed version. Check the Red Hat advisory and Bugzilla entry below for errata and remediation guidance. The record contains no CISA-required action because there is no KEV listing.