Live › vulnerability › CVE-2026-105311
Go to dashboardThe StreamsHub Console operator copies KafkaUser Secrets (SASL credentials or TLS private keys) from any namespace into a Secret the requesting tenant can read, because it lacks a same-namespace check. A Kubernetes tenant allowed to create a Console resource can read Kafka credentials belonging to other tenants.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Clusters running the StreamsHub Console operator (also shipped with Red Hat Streams for Apache Kafka) where non-admin tenants can create or update Console custom resources. Such a tenant can point kafkaUser.namespace at another namespace and read that namespace's Kafka SASL passwords or TLS private keys. Single-tenant clusters where only admins manage Console CRs can mostly skip it, but should still upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| streamshub-console | vendor | >= 0.2.0, < 0.12.10; >= 0.13.0, < 0.14.2 | 0.12.10, 0.14.2 |
kubectl get deploy -A -o wide | grep -i console, and check the operator image tag; versions >= 0.2.0 < 0.12.10 and >= 0.13.0 < 0.14.2 are affectedkubectl get console -A -o yaml and look for spec.kafkaClusters[].credentials.kafkaUser.namespace values that differ from the CR's own namespace0.14.2 (0.13.x/0.14.x) or 0.12.10 (0.12.x line)0.14.2 the operator checks that the Console service account may read the referenced KafkaUser Secret (SubjectAccessReview), so grant it a Role/RoleBinding on any KafkaUser Secrets it must useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.
This page as .md · .json · in your agent: get_signal("CVE-2026-105311")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.